Cryptographic processing system, key generation device, encryption device, decryption device, key delegation device, cryptographic processing method, and cryptographic processing program

ABSTRACT

Hierarchical predicate encryption (HPE) for inner products with enhanced efficiency of operations. A cryptographic processing system includes a key generation device, an encryption device, and a decryption device. The key generation device generates, as a decryption key sk L , a vector in which predicate information v{right arrow over ( )} t  is embedded in a basis vector of a basis B* t  for each integer t of t=1, . . . , L. The encryption device generates, as a ciphertext ct, a vector in which attribute information x{right arrow over ( )} t  is embedded in a basis vector of a basis B t  for at least some integer t of t=1, . . . , L. The decryption device performs a pairing operation on the decryption key sk L  generated by the key generation device and the ciphertext ct generated by the encryption device, and decrypts the ciphertext ct.

TECHNICAL FIELD

The present invention relates to hierarchical predicate encryption(HPE).

BACKGROUND ART

Non-Patent Literature 21 discusses HPE for inner products. Non-PatentLiterature 18 discusses functional encryption.

CITATION LIST Non-Patent Literature

Non-Patent Literature 1: Beimel, A., Secure schemes for secret sharingand key distribution. PhD Thesis, Israel Institute of Technology,Technion, Haifa, Israel, 1996.

Non-Patent Literature 2: Bethencourt, J., Sahai, A., Waters, B.:Ciphertext-policy attribute-based encryption. In:2007 IEEE Symposium onSecurity and Privacy, pp. 321•34. IEEE Press (2007)

Non-Patent Literature 3: Boneh, D., Boyen, X.: Efficient selective-IDsecure identity based encryption without random oracles. In: Cachin, C.,Camenisch, J. (eds.) EUROCRYPT 2004. LNCS, vol. 3027, pp. 223•38.Springer Heidelberg (2004)

Non-Patent Literature 4: Boneh, D., Boyen, X.: Secure identity basedencryption without random oracles. In:Franklin, M. K. (ed.) CRYPTO 2004.LNCS, vol. 3152, pp. 443•59. Springer Heidelberg (2004)

Non-Patent Literature 5: Boneh, D., Boyen, X., Goh, E.: Hierarchicalidentity based encryption with constant size ciphertext. In: Cramer, R.(ed.) EUROCRYPT 2005. LNCS, vol. 3494, pp. 440•56. Springer Heidelberg(2005)

Non-Patent Literature 6: Boneh, D., Franklin, M.: Identity-basedencryption from the Weil pairing. In: Kilian, J. (ed.) CRYPTO 2001.LNCS, vol. 2139, pp. 213•29. Springer Heidelberg (2001)

Non-Patent Literature 7: Boneh, D., Hamburg, M.: Generalized identitybased and broadcast encryption scheme. In:Pieprzyk, J. (ed.) ASIACRYPT2008. LNCS, vol. 5350, pp. 455•70. Springer Heidelberg (2008)

Non-Patent Literature 8: Boneh, D., Katz, J., Improved efficiency forCCA-secure cryptosystems built using identity based encryption. RSA-CT2005, LNCS, Springer Verlag (2005)

Non-Patent Literature 9: Boneh, D., Waters, B.: Conjunctive, subset, andrange queries on encrypted data. In:Vadhan, S. P. (ed.) TCC 2007. LNCS,vol. 4392, pp. 535•54. Springer Heidelberg (2007)

Non-Patent Literature 10: Boyen, X., Waters, B.: Anonymous hierarchicalidentity-based encryption (without random oracles). In: Dwork, C. (ed.)CRYPTO 2006. LNCS, vol. 4117, pp. 290•07. Springer Heidelberg (2006)

Non-Patent Literature 11: Canetti, R., Halevi S., Katz J.:Chosen-ciphertext security from identity-based encryption. EUROCRYPT2004, LNCS, Springer-Verlag (2004)

Non-Patent Literature 12: Cocks, C.: An identity based encryption schemebased on quadratic residues. In: Honary, B. (ed.) IMA Int. Conf. LNCS,vol. 2260, pp. 360•63. Springer Heidelberg (2001)

Non-Patent Literature 13: Gentry, C.: Practical identity-basedencryption without random oracles. In: Vaudenay, S. (ed.) EUROCRYPT2006. LNCS, vol. 4004, pp. 445•64. Springer Heidelberg (2006)

Non-Patent Literature 14: Gentry, C., Halevi, S.: Hierarchicalidentity-based encryption with polynomially many levels. In: Reingold,O. (ed.) TCC 2009. LNCS, vol. 5444, pp. 437•56. Springer Heidelberg(2009)

Non-Patent Literature 15: Gentry, C., Silverberg, A.: HierarchicalID-based cryptography. In: Zheng, Y. (ed.) ASIACRYPT 2002. LNCS, vol.2501, pp. 548•66. Springer Heidelberg (2002)

Non-Patent Literature 16: Goyal, V., Pandey, O., Sahai, A., Waters, B.:Attribute-based encryption for fine-grained access control of encrypteddata. In: ACM Conference on Computer and Communication Security 2006,pp. 89•8, ACM (2006)

Non-Patent Literature 17: Katz, J., Sahai, A., Waters, B.: Predicateencryption supporting disjunctions, polynomial equations, and innerproducts. In: Smart, N. P. (ed.) EUROCRYPT 2008. LNCS, vol. 4965, pp.146•62. Springer Heidelberg (2008)

Non-Patent Literature 18: Lewko, A., Okamoto, T., Sahai, A., Takashima,K., Waters, B.: Fully secure functional encryption: Attribute-basedencryption and (hierarchical) inner product encryption, EUROCRYPT 2010.LNCS, Springer Heidelberg (2010)

Non-Patent Literature 19: Lewko, A. B., Waters, B.: New techniques fordual system encryption and fully secure HIBE with short ciphertexts. In:Micciancio, D. (ed.) TCC 2010. LNCS, vol. 5978, pp. 455•79. SpringerHeidelberg (2010)

Non-Patent Literature 20: Okamoto, T., Takashima, K.: Homomorphicencryption and signatures from vector decomposition. In: Galbraith, S.D., Paterson, K. G. (eds.) Pairing 2008. LNCS, vol. 5209, pp. 57•4.Springer Heidelberg (2008)

Non-Patent Literature 21: Okamoto, T., Takashima, K.: Hierarchicalpredicate encryption for inner-products, In:ASIACRYPT 2009, SpringerHeidelberg (2009)

Non-Patent Literature 22: Ostrovsky, R., Sahai, A., Waters, B.:Attribute-based encryption with non-monotonic access structures. In: ACMConference on Computer and Communication Security 2007, pp. 195•03, ACM(2007)

Non-Patent Literature 23: Pirretti, M., Traynor, P., McDaniel, P.,Waters, B.: Secure attribute-based systems. In: ACM Conference onComputer and Communication Security 2006, pp. 99•12, ACM, (2006)

Non-Patent Literature 24: Sahai, A., Waters, B.: Fuzzy identity-basedencryption. In: Cramer, R. (ed.) EUROCRYPT 2005. LNCS, vol. 494, pp.457•73. Springer Heidelberg (2005)

Non-Patent Literature 25: Shi, E., Waters, B.: Delegating capability inpredicate encryption systems. In: Aceto, L., Damgaard, I., Goldberg, L.A., Halldorsson, M. M., Ingolfsdottir, A., Walukiewicz, I. (eds.) ICALP(2) 2008. LNCS, vol. 5126, pp. 560.578. Springer Heidelberg (2008)

Non-Patent Literature 26: Waters, B.: Efficient identity basedencryption without random oracles. Eurocrypt 2005, LNCS, vol. 3152, pp.443•59. Springer Verlag, (2005)

Non-Patent Literature 27: Waters, B.: Ciphertext-policy attribute-basedencryption: an expressive, efficient, and provably secure realization.ePrint, IACR, http://eprint.iacr.org/2008/290

Non-Patent Literature 28: Waters, B.: Dual system encryption: realizingfully secure IBE and HIBE under simple assumptions. In: Halevi, S. (ed.)CRYPTO 2009. LNCS, vol. 5677, pp. 619•36. Springer Heidelberg (2009)

DISCLOSURE OF INVENTION Technical Problem

In an HPE scheme for inner products discussed in Non-Patent Literature21, cryptographic processes are constructed using one large space. Thus,when this HPE scheme for inner products is implemented, key sizes couldbe large, adversely affecting efficiency of operations and so on.

It is an object of the present invention to provide an HPE scheme forinner products with enhanced efficiency of operations and so on.

Solution to Problem

A cryptographic processing system according to this invention is acryptographic processing system that performs a cryptographic processusing a basis B_(t) and a basis B*_(t) for each integer t of t=1, . . ., L+1 (L being an integer of 1 or more), the cryptographic processingsystem, and includes

an encryption device that generates, as a ciphertext ct, a vector inwhich attribute information x{right arrow over ( )}_(t) is embedded in abasis vector of the basis B_(t) for at least some integer t of t=1, . .. , L;

a decryption device that uses, as a decryption key sk_(L), a vector inwhich predicate information v{right arrow over ( )}_(t) is embedded in abasis vector of the basis B*_(t) for each integer t of t=1, . . . , L,performs a pairing operation on the ciphertext ct generated by theencryption device and the decryption key sk_(L), and decrypts theciphertext ct; and

a key delegation device that generates a lower-level decryption keysk_(L+1) of the decryption key sk_(L), based on a vector in whichpredicate information v{right arrow over ( )}_(L+1) is embedded in abasis vector of a basis B*_(L+1) and the decryption key sk_(L) used bythe decryption device.

Advantageous Effects of Invention

In a cryptographic processing system according to the present invention,a hierarchical structure is constructed using a plurality of spaces.Thus, key sizes can be made small, thereby enhancing efficiency ofoperations.

BRIEF DESCRIPTION OF DRAWINGS

FIG. 1 is a diagram for explaining a notion of “delegation (hierarchicaldelegation)”;

FIG. 2 is a diagram for explaining delegation skipping over a level;

FIG. 3 is a diagram showing hierarchical structures of attributeinformation and predicate information;

FIG. 4 is a diagram showing an example of hierarchical identity-basedencryption;

FIG. 5 is a diagram for explaining a basis and a basis vector;

FIG. 6 is a diagram for explaining an example of a method forimplementing a hierarchical structure in vector spaces;

FIG. 7 is a configuration diagram of a cryptographic processing system10 that executes algorithms of an HPE scheme for inner products.

FIG. 8 is a functional block diagram showing functions of a keygeneration device 100;

FIG. 9 is a functional block diagram showing functions of an encryptiondevice 200;

FIG. 10 is functional block diagram showing functions of a decryptiondevice 300;

FIG. 11 is a functional block diagram showing functions of a keydelegation device 400;

FIG. 12 is a flowchart showing a process of a Setup algorithm;

FIG. 13 is a flowchart showing a process of a KeyGen algorithm;

FIG. 14 is a flowchart showing a process of an Enc algorithm;

FIG. 15 is a flowchart showing a process of a Dec algorithm;

FIG. 16 is a flowchart showing a process of a Delegate_(L) algorithm;

FIG. 17 is a flowchart showing a process of a KeyGen algorithm;

FIG. 18 is a flowchart showing a process of the Dec algorithm;

FIG. 19 is a flowchart showing a process of the Delegate_(L) algorithm;and

FIG. 20 is a diagram showing an example of a hardware configuration ofthe key generation device 100, the encryption device 200, and thedecryption device 300.

DESCRIPTION OF PREFERRED EMBODIMENTS

Embodiments of the invention will now be described with reference todrawings.

In the following description, a processing device is a CPU 911 or thelike to be described later. A storage device is a ROM 913, a RAM 914, amagnetic disk 920 or the like to be described later. A communicationdevice is a communication board 915 or the like to be described later.An input device is a keyboard 902, the communication board 915 or thelike to be described later. An output device is the RAM 914, themagnetic disk 920, the communication board 915, an LCD 901 or the liketo be described later. That is, the processing device, the storagedevice, the communication device, the input device, and the outputdevice are hardware.

Notations to be used in the following description will be described.

When A is a random variable or distribution, Formula 101 denotes that yis randomly selected from A according to the distribution of A. That is,y is a random number in Formula 101.

$\begin{matrix}{y\overset{R}{\longleftarrow}A} & \lbrack {{Formula}\mspace{14mu} 101} \rbrack\end{matrix}$

When A is a set, Formula 102 denotes that y is uniformly selected fromA. That is, y is a uniform random number in Formula 102.

$\begin{matrix}{y\overset{U}{\longleftarrow}A} & \lbrack {{Formula}\mspace{14mu} 102} \rbrack\end{matrix}$

Formula 103 denotes that y is set, defined or substituted by z.y:=z  [Formula 103]

When a is a fixed value, Formula 104 denotes that a machine (algorithm)A outputs a on an input x.A(x)→a  [Formula 104]for example,A(x)→1

Formula 105, that is, F_(q), denotes a finite field of order q.

_(q)  [Formula 105]

A vector symbol denotes a vector representation over the finite fieldF_(q), that is, Formula 106.{right arrow over (x)} denotes(x₁, . . . , x_(n))ε

_(q).  [Formula 106]

Formula 107 denotes the inner product, shown in Formula 109, of twovectors x{right arrow over ( )} and v{right arrow over ( )} shown inFormula 108.{right arrow over (x)}·{right arrow over (v)}  [Formula 107]{right arrow over (x)}=(x ₁ , . . . , x _(n)),{right arrow over (v)}=(v ₁ , . . . , v _(n))  [Formula 108]Σ_(i=1) ^(n)x_(i)v_(i)  [Formula 109]

X^(T) denotes the transpose of a matrix X.

For a basis B and a basis B* shown in Formula 110, Formula 111 isdefined.

:=(b ₁ , . . . , b _(N)),

*:=(b* ₁ , . . . , b* _(N))  [Formula 110](X ₁ , . . . , x _(N)

:=Σ_(i=1) ^(N) x _(i) b _(i),(y ₁ , . . . , y _(N)

:=Σ_(i=1) ^(N) y _(i) b* _(i)  [Formula 111]

e{right arrow over ( )}_(t,j) denotes an orthonormal basis vector shownin Formula 112.

$\begin{matrix}{{{{\overset{arrow}{e}}_{t,j}\text{:}\mspace{11mu}\overset{\overset{j - 1}{︷}}{( {0\mspace{14mu}\ldots\mspace{14mu} 0} }},1,{\overset{\overset{n_{t} - j}{︷}}{ {0\mspace{14mu}\ldots\mspace{14mu} 0} )}\varepsilon\mspace{11mu}{??}_{q}^{n_{t}}}}{for}{{j = 1},\ldots\mspace{11mu},n_{t}}} & \lbrack {{Formula}\mspace{14mu} 112} \rbrack\end{matrix}$

Formula 113 to Formula 117 are defined.

$\begin{matrix}{{( {( {\overset{arrow}{x}}_{0} )_{{??}_{0}^{*}},\ldots\mspace{11mu},( {\overset{arrow}{x}}_{d} )_{{??}_{d}^{*}}} ) + ( {( {\overset{arrow}{y}}_{0} )_{{??}_{0}^{*}},\ldots\mspace{11mu},( {\overset{arrow}{y}}_{d} )_{{??}_{d}^{*}}} )}:=( {( {{\overset{arrow}{x}}_{0} + {\overset{arrow}{y}}_{0}} )_{{??}_{0}^{*}},\ldots\mspace{11mu},( {{\overset{arrow}{x}}_{d} + {\overset{arrow}{y}}_{d}} )_{{??}_{d}^{*}}} )} & \lbrack {{Formula}\mspace{14mu} 113} \rbrack \\{(x)_{{??}_{t}^{*}}:=( {( \overset{arrow}{0} )_{{??}_{0}^{*}},\ldots\mspace{11mu},( \overset{arrow}{0} )_{{??}_{t - 1}^{*}},( \overset{arrow}{x} )_{{??}_{t}^{*}},( \overset{arrow}{0} )_{{??}_{t + 1}^{*}},\ldots\mspace{11mu},( \overset{arrow}{0} )_{{??}_{d}^{*}}} )} & \lbrack {{Formula}\mspace{14mu} 114} \rbrack \\{\mspace{79mu}{( {( {\overset{arrow}{x}}_{i} )_{{??}_{i}^{*}},( {\overset{arrow}{x}}_{j} )_{{??}_{j}^{*}}} ):=( {( {\overset{arrow}{x}}_{i} )_{{??}_{i}^{*}} + ( {\overset{arrow}{x}}_{j} )_{{??}_{j}^{*}}} }} & \lbrack {{Formula}\mspace{14mu} 115} \rbrack \\{( {( {\overset{arrow}{x}}_{0} )_{{??}_{0}^{*}},{( {\overset{arrow}{x}}_{t} )_{{??}_{t}^{*}};{t = 1}},{\ldots\mspace{11mu} L}} ):=( {( {\overset{arrow}{x}}_{0} )_{{??}_{0}^{*}},\ldots\mspace{11mu},( {\overset{arrow}{x}}_{L} )_{{??}_{L}^{*}}} )} & \lbrack {{Formula}\mspace{14mu} 116} \rbrack \\{\mspace{79mu}{{{e( {c,k^{*}} )}:={\prod\limits_{t = 0}^{d}\;{e( {c_{t},k_{t}^{*}} )}}},\mspace{79mu}{{{where}\mspace{14mu} c}:=( {{c_{0}\varepsilon\langle {??}_{0} \rangle},\ldots\mspace{11mu},{c_{d}\varepsilon\langle {??}_{d} \rangle}} )},\mspace{79mu}{k^{*}:=( {{k_{L,0}^{*}\varepsilon\langle {??}_{0}^{*} \rangle},\ldots\mspace{11mu},{k_{d}^{*}\varepsilon\langle {??}_{d}^{*} \rangle}} )}}} & \lbrack {{Formula}\mspace{14mu} 117} \rbrack\end{matrix}$

For Formula 118, Formula 119 is defined.k*:=(({right arrow over (x)} ₀

, . . . , ({right arrow over (x)} _(d)

)  [Formula 118][k*] ^(L):=(({right arrow over (x)} ₀

, . . . , ({right arrow over (x)} _(L)

, ({right arrow over (0)}

, . . . , ({right arrow over (0)}

),[k*] _(L):=(({right arrow over (0)}

, . . . , ({right arrow over (0)}

,({right arrow over (x)} _(L+1)

, . . . , ({right arrow over (x)} _(d)

)  [Formula 119]

In the following description, nt in F_(q) ^(nt) denotes n_(t).

Likewise, (v→1, . . . , v→L) in a secret key sk_((v→1, . . . , v→L))denotes (v{right arrow over ( )}₁, . . . , v{right arrow over ( )}_(L)),and (v→1, . . . , v→L+1) in a secret key sk_((v→1, . . . , v→L+1))denotes (v{right arrow over ( )}₁, . . . , v{right arrow over ()}_(L+1)).

Likewise, when “δi,j” is shown as a superscript, this δi,j denotesδ_(i,j).

When “→” representing a vector is attached to a subscript orsuperscript, this “→” is attached as a superscript to the subscript orsuperscript.

In the following description, a cryptographic process includes anencryption process, a decryption process, a key generation process, anda key delegation process.

First Embodiment

In this embodiment, basic concepts for implementing “HPE for innerproducts” and constructions of “HPE for inner products” will bedescribed.

Firstly, a notion of HPE for inner products will be described. Todescribe the notion of HPE for inner products, a notion of “delegation”will be described first, together with a notion of “hierarchicaldelegation”. Then, “predicate encryption (PE) for inner products” willbe described. Then, “HPE for inner products”, which is a type of PE forinner products with the notion of hierarchical delegation, will bedescribed. Further, to reinforce the understanding of HPE for innerproducts, an application example of HPE for inner products will bedescribed.

Secondly, HPE for inner products in vector spaces will be described. Inthis and subsequent embodiments, HPE and hierarchical predicate keyencapsulation mechanism (HPKEM) are implemented in vector spaces. “Abasis” and “a basis vector” will be described first. Then, “PE for innerproducts in vector spaces” will be described. Then, “a method forimplementing a hierarchical structure in vector spaces” will bedescribed. Further, to reinforce the understanding, an implementationexample of the hierarchical structure will be described.

Thirdly, “dual pairing vector spaces (DPVS)” having rich mathematicalstructures for implementing HPE for inner products will be described.

Fourthly, basic constructions of “an HPE scheme for inner products”according to this embodiment will be described. Then, basicconstructions of “a cryptographic processing system 10” that implementsHPE will be described. Then, the HPE scheme and the cryptographicprocessing system 10 according to this embodiment will be described indetail.

<1. HPE for Inner Products>

<1-1. Notion of Delegation (Hierarchical Delegation)>

FIG. 1 is a diagram for explaining the notion of “delegation(hierarchical delegation)”.

Delegation means that a user who has a higher-level key generates alower-level key having more limited capabilities than the user's(higher-level) key.

In FIG. 1, a root (key generation device) generates secret keys forfirst-level (level-1) users by using a master secret key. That is, theroot generates keys 1, 2, and 3 for first-level users 1, 2, and 3,respectively. Then, using the key 1, for example, the user 1 cangenerate keys 11, 12, and 13 for users 11, 12, and 13, respectively, whoare lower-level (second-level) users of the user 1. The keys 11, 12, and13 owned by the users 11, 12, and 13 have more limited capabilities thanthe key 1 owned by the user 1. The limited capabilities mean thatciphertexts that can be decrypted by that secret key are limited. Thatis, a lower-level secret key can only decrypt some of ciphertexts thatcan be decrypted by a higher-level secret key. This means that the keys11, 12, and 13 owned by the users 11, 12, and 13 can only decrypt someof ciphertexts that can be decrypted by the key 1 owned by the user 1.Generally, the keys 11, 12, and 13 can decrypt respectively differentciphertexts. On the other hand, a ciphertext that can be decrypted bythe keys 11, 12, or 13 can be decrypted by the key 1.

As shown in FIG. 1, each secret key is provided for a specific level.This is described as “hierarchical”. That is, as shown in FIG. 1,hierarchical generation of lower-level keys is called “hierarchicaldelegation”.

In FIG. 1, it has been described that the root generates the secret keysfor the first-level users, the first-level users generate the secretkeys for the second-level users, and the second-level users generate thesecret keys for the third-level users. However, as shown in FIG. 2, theroot can generate not only the secret keys for the first-level users,but also the secret keys for the second-level or lower-level users.Likewise, the first-level users can generate not only the secret keysfor the second-level users, but also the secret keys for the third-levelor lower-level users. That is, the root or each user can generate thesecret keys for levels lower than the level of its own secret key.

<1-2. PE for Inner Products>

Next, “PE for inner products” will be described.

PE is a cryptographic scheme in which a ciphertext can be decrypted if aresult of inputting attribute information x to predicate informationf_(v) is 1 (true) (f_(v)(x)=1). Generally, the attribute information xis embedded in a ciphertext, and the predicate information f_(v) isembedded in a secret key. That is, in PE, a ciphertext c encrypted basedon the attribute information x is decrypted by a secret key SK_(f)generated based on the predicate information f_(v). PE may be describedas a cryptographic scheme in which, for example, the predicateinformation f_(v) is a conditional expression and the attributeinformation x is information to be input to the conditional expression,and a ciphertext can be decrypted if the input information (attributeinformation x) satisfies the conditional expression (predicateinformation f_(v)) (f_(v)(x)=1).

PE is discussed in detail in Non-Patent Literature 17.

PE for inner products is a type of PE in which f_(v)(x)=1 if the innerproduct of attribute information x and predicate information f_(v) is apredetermined value. That is, a ciphertext c encrypted by the attributeinformation x can be decrypted by a secret key SK_(f) generated based onthe predicate information f_(v) if and only if the inner product of theattribute information x and the predicate information f_(v) is apredetermined value.

In the first embodiment, it is assumed as a general rule that f_(v)(x)=1if the inner product of the attribute information x and the predicateinformation f_(v) is 0.

<1-3. HPE for Inner Products>

HPE for inner products (HPKEM for inner products) is a type of “PE forinner products” with the above-described notion of “hierarchicaldelegation”.

In HPE for inner products, attribute information and predicateinformation have hierarchical structures, in order to incorporate ahierarchical delegation system in PE for inner products.

FIG. 3 is a diagram showing hierarchical structures of attributeinformation and predicate information.

In FIG. 3, attribute information and predicate information with the samereference numerals correspond to each other (i.e., their inner productis 0). That is, the inner product of an attribute 1 and a predicate 1 is0, the inner product of an attribute 11 and a predicate 11 is 0, theinner product of an attribute 12 and a predicate 12 is 0, and the innerproduct of an attribute 13 and a predicate 13 is 0. This means that aciphertext c1 encrypted by the attribute 1 can be decrypted by a secretkey k1 generated based on the predicate 1. A ciphertext c11 encrypted bythe attribute 11 can be decrypted by a secret key k11 generated based onthe predicate 11. The same can be said of the attribute 12 and thepredicate 12 as well as the attribute 13 and the predicate 13.

As described above, HPE for inner products has the hierarchicaldelegation system. Thus, the secret key k11 can be generated based onthe predicate 11 and the secret key k1 generated based on the predicate1. That is, a user having the higher-level secret key k1 can generateits lower-level secret key k11 from the secret key k1 and thelower-level predicate 11. Likewise, a secret key k12 can be generatedfrom the secret key k1 and the predicate 12, and a secret key k13 can begenerated from the secret key k1 and the predicate 13.

A ciphertext encrypted by a key (public key) corresponding to alower-level secret key can be decrypted by a higher-level secret key. Onthe other hand, a ciphertext encrypted by a key (public key)corresponding to a higher-level secret key cannot be decrypted by alower-level secret key. That is, the ciphertexts c11, c12, and c13encrypted by the attributes 11, 12, and 13, respectively, can bedecrypted by the secret key k1 generated based on the predicate 1. Onthe other hand, the ciphertext c1 encrypted by the attribute 1 cannot bedecrypted by the secret keys k11, k12, and k13 generated based on thepredicates 11, 12, and 13, respectively. That is, the inner product ofthe attribute 11, 12, or 13 and the predicate 1 is 0. On the other hand,the inner product of the attribute 1 and the predicate 11, 12, or 13 isnot 0.

<1-4. Application Example of HPE for Inner Products>

FIG. 4 is a diagram showing an example of hierarchical identity-basedencryption (HIBE), which is an application example of the HPE scheme forinner products to be described later. HIBE is a cryptographic process inwhich the notion of hierarchical is applied to identity-based encryption(IBE). IBE is a type of PE, namely, matching PE, which allows aciphertext to be decrypted if an ID included in the ciphertext matchesan ID included in a secret key.

In the example shown in FIG. 4, based on a master secret key sk and anID “A” of Company A, a root (key generation device) generates a secretkey (key A) corresponding to the ID “A”. For example, based on the key Aand the ID of each division, a security administrator of Company Agenerates a secret key corresponding to that ID. For example, thesecurity administrator generates a secret key (key 1) corresponding toan ID “A-1” of a sales division. Then, based on the secret key of eachdivision and the ID of each unit belonging to that division, forexample, an administrator of each division generates a secret keycorresponding to that ID. For example, an administrator of the salesdivision generates a secret key (key 11) corresponding to an ID “A-11”of a sales unit 1.

In this case, a ciphertext encrypted by the ID “A-11” of the sales unit1 can be decrypted by the key 11 which is the secret key correspondingto the ID “A-11” of the sales unit 1. However, a ciphertext encrypted bythe ID of a sales unit 2 or a sales unit 3 cannot be decrypted by thekey 11. Also, a ciphertext encrypted by the ID of the sales divisioncannot be decrypted by the key 11.

A ciphertext encrypted by the ID “A-1” of the sales division can bedecrypted by the key 1 which is the secret key corresponding to the ID“A-1” of the sales division. Also, a ciphertext encrypted by the ID of aunit belonging to the sales division can be decrypted by the key 1. Thatis, a ciphertext encrypted by the ID of the sales unit 1, 2, or 3 can bedecrypted by the key 1. However, a ciphertext encrypted by the ID of amanufacturing division (ID: A-2) or a staff division (ID: A-3) cannot bedecrypted by the key 1. Also, a ciphertext encrypted by the ID ofCompany A cannot be decrypted by the key 1.

A ciphertext encrypted by the ID “A” of Company A can be decrypted bythe key A which is the secret key corresponding to the ID “A” of CompanyA. Also, a ciphertext encrypted by the ID of each division belonging toCompany A or the ID of a unit belonging to each division can bedecrypted by the key A.

HPE for inner products can be adapted to various applications other thanIBE. In particular, cryptographic processes to be described later arenot limited to a class of equality tests, so that they can be applied toa vast number of applications. For example, with respect to searchableencryption or the like which is a type of PE for inner products, thecryptographic processes allow applications that cannot be implementedwith conventional PE having the delegation system, such as limiting asearchable range at each level by using a conditional expression such asAND or OR.

That is, the HPKEM and HPE schemes to be described in the subsequentembodiments can be applied to a wide variety of applications such as IBEand searchable encryption.

<2. HPE for Inner Products in Vector Spaces>

HPKEM and HPE are implemented in high-dimensional vector spaces calleddual pairing vector spaces (DPVS) to be described later. Thus, HPE forinner products in vector spaces will be described.

<2-1. Basis and Basis Vector>

First, “a basis” and “a basis vector” to be used for explaining a vectorspace will be briefly explained.

FIG. 5 is a diagram for explaining the basis and the basis vector.

FIG. 5 shows a vector v of a 2-dimensional vector space. The vector v isc₁a₁+c₂a₂. Further, the vector v is y₁b₁+y₂b₂. Here, a₁ and a₂ arecalled basis vectors in a basis A, and are represented as basis A:=(a₁,a₂). b₁ and b₂ are called basis vectors in a basis B, and arerepresented as basis B:=(b₁, b₂). c₁, c₂, y₁, and y₂ are coefficients ofrespective basis vectors. FIG. 5 shows a 2-dimensional vector space, sothat there are two basis vectors in each basis. In an N-dimensionalvector space, there are an N number of basis vectors in each basis.

<2-2. PE for Inner Products in Vector Spaces>

PE for inner products in vector spaces will now be described.

As described above, PE for inner products is a type of PE in whichf_(v)(x)=1 if the inner product of the attribute information x and thepredicate information f_(v) is a predetermined value (0 in this case).When the attribute information x and the predicate information f_(v) arevectors, namely, an attribute vector x{right arrow over ( )} and apredicate vector v{right arrow over ( )}, their inner-product predicateis defined as shown in Formula 120.If {right arrow over (x)}·{right arrow over (v)}=Σ _(i=1) ^(n) x _(i) v_(i)=0, then f _({right arrow over (v)})({right arrow over (x)})=1, andif {right arrow over (x)}·{right arrow over (v)}=Σ _(i=1) ^(n) x _(i) v_(i)≠0, then f _({right arrow over (v)})({right arrow over(x)})=0,  [Formula 120]where

-   {right arrow over (x)}=(x₁, . . . , x_(n)),-   {right arrow over (v)}=(v₁, . . . , v_(n)).

That is, it is a type of PE in which a result of inputting the attributeinformation x to the predicate information f_(v) is 1 (true) if theinner product of the attribute vector x{right arrow over ( )} and thepredicate vector {right arrow over (v)} (i.e., the sum of element-wiseinner products) is 0, and a result of inputting the attributeinformation x to the predicate information f_(v) is 0 (false) if theinner product of the attribute vector x{right arrow over ( )} and thepredicate vector v{right arrow over ( )} is not 0.

<2-3. Method for Implementing a Hierarchical Structure in Vector Spaces>

A method for implementing a hierarchical structure in vector spaces willnow be described.

FIG. 6 is a diagram for explaining an example of the method forimplementing a hierarchical structure in vector spaces.

A d number (d is an integer of 1 or more) of vector spaces will bediscussed here. Each vector space is a high-dimensional(N_(t)-dimensional (t=1, . . . , d)) vector space. That is, there existan N_(t) number of basis vectors c_(i) (i=1, . . . , N_(t)) in apredetermined basis C_(t) (t=1, . . . , d) in each vector space.

A basis C₁ is a space for setting attribute information and predicateinformation of a first level. A basis C₂ is a space for settingattribute information and predicate information of a second level.Likewise, a basis C_(L) is a space for setting attribute information andpredicate information of an L-th level. Thus, d levels can berepresented here.

A secret key of the L-th level is generated not only by setting thepredicate information of the L-th level using the basis C_(L), but alsoby setting the predicate information of the first to (L−1)-th levelsusing the bases C₁ to C_(L−1). That is, in a lower-level secret key, thepredicate information to be set in a higher-level secret key is alsoset. This arrangement allows the predicate information to have ahierarchical structure. Then, using the hierarchical structure of thepredicate information, a delegation system in PE for inner products isconstructed.

In the following description, a format of hierarchy n{right arrow over ()}:=(d; N₁, . . . , N_(d)) is used to denote the hierarchical structurein a vector space, where d is a value representing the depth of levelsdescribed above, and N_(i) (i=1, . . . , d) is a value representing thenumber of dimensions, that is, the number of basis vectors, allocated toeach level i.

<2-4. Implementation Example of the Hierarchical Structure>

The hierarchical structure will be explained using a simple example.Explanation will be given using an example where there are three levelsand each level is allocated a two-dimensional space. That is, n{rightarrow over ( )}:=(d; N₁, . . . , N_(d))=(3; 2, 2, 2).

A user who has a first-level secret key sk₁ generated based on afirst-level predicate vector v{right arrow over ( )}₁:=(v₁, v₂) cangenerate a second-level secret key sk₂ based on the first-level secretkey sk₁ and a second-level predicate vector v{right arrow over ()}₂:=(v₃, v₄). That is, the second-level secret key sk₂ is generatedbased on the predicate vectors (v{right arrow over ( )}₁, v{right arrowover ( )}₂). Likewise, a user who has the second-level secret key sk₂can generate a third-level secret key sk₃ based on the second-levelsecret key sk₂ and a third-level predicate vector v{right arrow over ()}₃:=(v₅, v₆). That is, the third-level secret key sk₃ is generatedbased on the predicate vectors (v{right arrow over ( )}₁, v{right arrowover ( )}₂, v{right arrow over ( )}₃).

The first-level secret key sk₁ generated based on the first-levelpredicate vector v{right arrow over ( )}₁ is a secret key generated by(v{right arrow over ( )}₁, (0, 0), (0, 0)). Thus, the first-level secretkey sk₁ can decrypt a ciphertext encrypted by an attribute vector(x{right arrow over ( )}₁, (*, *), (*, *)):=((x₁, x₂), (*, *), (*, *))if v{right arrow over ( )}₁·x{right arrow over ( )}₁=0. This is because(*, *)·(0, 0)=0. Here, “*” denotes an arbitrary value.

Likewise, the second-level secret key sk₂ generated based on thesecond-level predicate vectors (v{right arrow over ( )}₁, v{right arrowover ( )}₂) is a secret key generated by (v{right arrow over ( )}₁,v{right arrow over ( )}₂, (0, 0)). Thus, the second-level secret key sk₂can decrypt a ciphertext encrypted by attribute vectors (x{right arrowover ( )}₁, x{right arrow over ( )}₂, (*, *))=((x₁, x₂), (x₃, x₄), (*,*)) if v{right arrow over ( )}₁·x{right arrow over ( )}₁=0 and v{rightarrow over ( )}₂·x{right arrow over ( )}₂=0.

However, the second-level secret key sk₂ cannot decrypt a ciphertextencrypted by the first-level attribute vector x{right arrow over ()}₁:=(x₁, x₂) (i.e., (x{right arrow over ( )}₁, (*, *), (*, *)). This isbecause if not v{right arrow over ( )}₂=(0, 0), then (*, *)·v{rightarrow over ( )}₂≠0 and v{right arrow over ( )}₂·x{right arrow over ()}₂≠0. Therefore, it can be stated that the second-level secret key sk₂has more limited capabilities than the parent secret key sk₁.

<3. Dual Pairing Vector Spaces (DPVS)>

Symmetric bilinear pairing groups will be described first.

Symmetric bilinear pairing groups (q, G, G^(T), g, e) are a tuple of aprime q, a cyclic additive group G of order q, a cyclic multiplicativegroup G^(T) of order q, g≠0εG, and a polynomial-time computablenondegenerate bilinear pairing e: G×G→G_(T). The nondegenerate bilinearpairing is e(sg, tg)=e(g, g)^(st) and e(g,g)≠1.

In the following description, Formula 121 is an algorithm that takes1_(λ) as input and outputs values of parameter param_(G):=(q, G, G_(T),g, e) of bilinear pairing groups with a security parameter λ.G_(bpg)  [Formula 121]

Dual pairing vector spaces will now be described.

Dual pairing vector spaces (q, V, G_(T), A, e) can be constructed by adirect product of the symmetric bilinear pairing groups (param_(G):=(q,G, G_(T), g, e)). The dual pairing vector spaces (q, V, G_(T), A, e) area tuple of a prime q, an N-dimensional vector space V over F_(q) shownin Formula 122, a cyclic group G_(T) of order q, and a canonical basisA:=(a₁, . . . , a_(N)) of the space V, and have the following operations(1) and (2). Here, a_(i) is as shown in Formula 123.

$\begin{matrix}{{??}:=\overset{\overset{N}{︷}}{{??} \times \ldots \times {??}}} & \lbrack {{Formula}\mspace{14mu} 122} \rbrack \\{a_{i}:=( {\overset{\overset{i - 1}{︷}}{0,\ldots\mspace{11mu},0},g,\overset{\overset{N - i}{︷}}{0,\ldots\mspace{11mu},0}} )} & \lbrack {{Formula}\mspace{14mu} 123} \rbrack\end{matrix}$

Operation (1): Nondegenerate Bilinear Pairing

A pairing in the space V is defined by Formula 124.e(x,y):=Π_(i=1) ^(N) e(G _(i) ,H _(i))ε

_(T)  [Formula 124]where

-   (G₁, . . . , G_(N)):=xε-   (H₁, . . . , H_(N)):=yε

This is nondegenerate bilinear, that is, e(sx, ty)=e(x, y)^(st) and ife(x, y)=1 for all yεV, then x=0. For all i and j, e(a_(i), a_(j))=e(g,g)^(δi,j), where δ_(i,j)=1 if i=j, and δ_(i,j)=0 if i≠j, and e(g,g)≠1εG_(T).

Operation (2): Distortion Maps

Linear transformations φ_(i,j) on the space V shown in Formula 125 canachieve Formula 126.

$\begin{matrix}{{{{If}\mspace{14mu}{\phi_{i,j}( a_{j} )}} = a_{i}}{and}{{k \neq j},{then}}{{\phi_{i,j}( a_{k} )} = 0.}} & \lbrack {{Formula}\mspace{14mu} 125} \rbrack \\{{{\phi_{i,j}(x)}:=( {\overset{\overset{i - 1}{︷}}{0,\ldots\mspace{11mu},0},g_{j},\overset{\overset{N - i}{︷}}{0,\ldots\mspace{11mu},0}} )}{{{where}( {g_{1},{\ldots\mspace{14mu} g_{N}}} )}:={x.}}} & \lbrack {{Formula}\mspace{14mu} 126} \rbrack\end{matrix}$

The linear transformations φ_(i,j) will be called distortion maps.

In the following description, Formula 127 is an algorithm that takes asinput 1^(λ) (λεnatural number), Nεnatural number, and values ofparameter param_(G):=(q, G, G_(T), g, e) of bilinear pairing groups, andoutputs values of parameter param_(v):=(q, V, G_(T), A, e) of dualpairing vector spaces with a security parameter λ and an N-dimensionalspace V.G_(dpvs)  [Formula 127]

Description will be directed herein to a case where the dual pairingvector spaces are constructed using the above-described symmetricbilinear pairing groups. The dual pairing vector spaces can also beconstructed using asymmetric bilinear pairing groups. The followingdescription can easily be adapted to a case where the dual pairingvector spaces are constructed using asymmetric bilinear pairing groups.

<4. Construction of HPE and Cryptographic Processing System 10>

<4-1. Basic Construction of HPE for Inner Products>

A construction of the HPE scheme for inner products will be brieflydescribed.

The HPE scheme for inner products includes five probabilisticpolynomial-time algorithms: Setup, KeyGen, Enc, Dec, and Delegate_(L)(L=1, . . . , d−1).

(Setup)

The Setup algorithm takes as input a security parameter 1^(λ) and aformat of hierarchy n{right arrow over ( )}:=(d; N₀, . . . , N_(d)), andoutputs a master public key pk and a master secret key sk. The mastersecret key sk is a top-level key.

(KeyGen)

The KeyGen algorithm takes as input the master public key pk, the mastersecret key sk, and predicate vectors (v{right arrow over ( )}₁, . . . ,v{right arrow over ( )}_(L)) (1≦L≦d), and outputs an L-th-level secretkey sk_((v→1, . . . , v→L)).

(Enc)

The Enc algorithm takes as input the master public key pk, attributevectors (x{right arrow over ( )}₁, . . . , x{right arrow over ( )}_(h))(1≦h≦d), and a message m, and outputs a ciphertext ct (encrypted text).That is, the Enc algorithm outputs the ciphertext ct containing themessage m and encrypted by the attribute vectors (x{right arrow over ()}₁, . . . , x{right arrow over ( )}_(h)).

(Dec)

The Dec algorithm takes as input the master public key pk, theL-th-level secret key sk_((v→1, . . . , v→L)), and the ciphertext ct,and outputs the message m or a distinguished symbol ⊥. The distinguishedsymbol ⊥ is information indicating decryption failure. That is, the Decalgorithm decrypts the ciphertext ct by the L-th-level secret key, andextracts the message m. In case of decryption failure, the Dec algorithmoutputs the distinguished symbol ⊥.

(Delegate_(L))

Delegate_(L), takes as input the master public key pk, the L-th-levelsecret key sk_((v→1, . . . , v→L)), and an (L+1)-th-level predicatevector v{right arrow over ( )}_(L+1) (L+1≦d), and outputs an(L+1)-th-level secret key sk_((v→1, . . . , v→L+1)). That is, theDelegate_(L) algorithm outputs a lower-level secret key.

<4-2. Cryptographic Processing System 10>

The cryptographic processing system 10 that executes the algorithms ofthe HPE scheme for inner products will be described.

FIG. 7 is a configuration diagram of the cryptographic processing system10 that executes the algorithms of the HPE scheme for inner products.

The cryptographic processing system 10 includes a key generation device100, an encryption device 200, a decryption device 300, and a keydelegation device 400. Description will be given herein assuming thatthe decryption device 300 includes the key delegation device 400.However, the key delegation device 400 may be provided separately fromthe decryption device 300.

The key generation device 100 executes the Setup algorithm taking asinput a security parameter λ and a format of hierarchy n{right arrowover ( )}:=(d; N₀, . . . , N_(d)), and generates a master public key pkand a master secret key sk. Then, the key generation device 100 makespublic the generated master public key pk. The key generation device 100also executes the KeyGen algorithm taking as input the master public keypk, the master secret key sk, and predicate vectors (v{right arrow over( )}₁, . . . , v{right arrow over ( )}_(L)) (1≦L≦d), generates anL-th-level secret key sk_((v→1, . . . , v→L)), and secretly provides theL-th-level secret key to the L-th-level decryption device 300.

The encryption device 200 executes the Enc algorithm taking as input themaster public key pk, attribute vectors (x{right arrow over ( )}₁, . . ., x{right arrow over ( )}_(h)) (1≦h≦d), and a message m, and generates aciphertext ct. The encryption device 200 transmits the generatedciphertext ct to the decryption device 300.

The decryption device 300 executes the Dec algorithm taking as input themaster public key pk, the L-th-level secret key sk_((v→1, . . . , v→L)),and the ciphertext ct, and outputs the message m or the distinguishedsymbol ⊥.

The key delegation device 400 executes the Delegate_(L) algorithm takingas input the master public key pk, the L-th-level secret keysk_((v→1, . . . , v→L)), and an (L+1)-th-level predicate vector v{rightarrow over ( )}_(L+1) (L+1≦d), and generates an (L+1)-th-level secretkey sk_((v→1, . . . , v→L+1)), and secretly provides the (L+1)-th-levelsecret key to the (L+1)-th-level decryption device 300.

<4-3. Details of HPE Scheme for Inner Products and CryptographicProcessing System 10>

Referring to FIGS. 8 to 16, description will be directed to the HPEscheme for inner products according to the first embodiment. Descriptionwill also be directed to functions and operations of the cryptographicprocessing system 10 that implements the HPE scheme for inner products.

FIG. 8 is a functional block diagram showing functions of the keygeneration device 100. FIG. 9 is a functional block diagram showingfunctions of the encryption device 200. FIG. 10 is a functional blockdiagram showing functions of the decryption device 300. FIG. 11 is afunctional block diagram showing functions of the key delegation device400.

FIGS. 12 and 13 are flowcharts showing operations of the key generationdevice 100. FIG. 12 is a flowchart showing a process of the Setupalgorithm. FIG. 13 is a flowchart showing a process of the KeyGenalgorithm. FIG. 14 is a flowchart showing operations of the encryptiondevice 200 and showing a process of the Enc algorithm. FIG. 15 is aflowchart showing operations of the decryption device 300 and showing aprocess of the Dec algorithm. FIG. 16 is a flowchart showing operationsof the key delegation device 400 and showing a process of theDelegate_(L) algorithm.

In the following description, a subscript “dec” stands for “decryption”.The subscript “dec” indicates a decryption element used for decrypting aciphertext. A subscript “ran” stands for “randomization”. The subscript“ran” indicates a randomizing element for randomizing the coefficient ofa predetermined basis vector of a lower-level decryption key. Asubscript “del” stands for “delegation”. The subscript “del” indicates adelegation element for generating a lower-level decryption key.

The functions and operations of the key generation device 100 will bedescribed.

As shown in FIG. 8, the key generation device 100 includes a master keygeneration unit 110, a master key storage unit 120, an information inputunit 130 (first information input unit), a decryption key generationunit 140, and a key distribution unit 150 (decryption key transmissionunit).

The decryption key generation unit 140 includes a random numbergeneration unit 141, a decryption element generation unit 142, arandomizing element generation unit 143, and a delegation elementgeneration unit 144.

Referring to FIG. 12, the process of the Setup algorithm will bedescribed first.

(S101: Orthonormal Basis Generation Step)

Using the processing device, the master key generation unit 110 computesFormula 128, and randomly generates param_(n→) as well as a basis B_(t)and a basis B*_(t) for each integer t of t=0, . . . , d.

$\begin{matrix}\lbrack {{Formula}\mspace{14mu} 128} \rbrack & \; \\{\mspace{79mu}{{input}{1^{\lambda},{\overset{arrow}{n}:=( {d;{\overset{arrow}{n}:=( {{d;n_{1}},\ldots\mspace{11mu},n_{d},u_{0},\ldots\mspace{11mu},u_{d},w_{0},\ldots\mspace{11mu},w_{d},z_{0},\ldots\mspace{11mu},z_{d}} )}} )}}\mspace{20mu}{{N_{0}:={1 + u_{0} + 1 + w_{0} + z_{0}}};}\mspace{20mu}{N_{t}:={n_{t} + u_{t} + w_{t} + {z_{t}( {{t = 1},\ldots,d} )}}}}} & (1) \\{\mspace{79mu}{{param}_{??}:={( {q,{??},{??}_{T},g,e} )\overset{R}{\longleftarrow}{{??}_{bpg}( 1^{\lambda} )}}}} & (2) \\{\mspace{79mu}{{\psi\overset{U}{\longleftarrow}{??}_{q}^{x}},\mspace{20mu}{{{Steps}\mspace{14mu}(4)\mspace{14mu}{to}\mspace{14mu}(8)\mspace{14mu}{are}\mspace{14mu}{executed}\mspace{14mu}{for}\mspace{14mu}{each}\mspace{14mu} t\mspace{14mu}{of}\mspace{14mu} t} = 0},\ldots\mspace{14mu},{d.}}} & (3) \\{{param}_{{??}_{t}}:={( {q,{??}_{t},{??}_{T},{??}_{t},e} ):={{??}_{dpvs}( {1^{\lambda},N_{t},{param}_{??}} )}}} & (4) \\{\mspace{79mu}{X_{t}:={( \chi_{t,i,j} )_{i,j}\overset{U}{\longleftarrow}{{GL}( {N_{t},{??}_{q}} )}}}} & (5) \\{\mspace{79mu}{( v_{t,i,j} )_{i,j}:={{\psi \cdot ( X_{t}^{T} )} - 1}}} & (6) \\{\mspace{79mu}{{??}_{t}:=( {b_{t,1},\ldots\mspace{11mu},b_{t},N_{t}} )}} & (7) \\{\mspace{79mu}{{??}_{t}^{*}:=( {b_{t,1}^{*},\ldots\mspace{11mu},{b_{t,}^{*}N_{t}}} )}} & (8) \\{\mspace{79mu}{{param}_{\overset{arrow}{n}}:=( {\{ {param}_{{??}_{t}} \}_{{t = 0},\;\ldots\mspace{11mu},d,}g_{T}} )}} & (9)\end{matrix}$

That is, the master key generation unit 110 executes the followingsteps.

(1) Using the input device, the master key generation unit 110 inputs asecurity parameter λ(1^(λ)) and a format of attribute n{right arrow over( )}:=(d; n₁, . . . , n_(d), u₀, . . . , u_(d), w₀, . . . , w_(d), z₀, .. . , z_(d)), where d is an integer of 1 or more, n_(t) is an integer of1 or more for each integer t of t=1, . . . , d, and u_(t), w_(t), z_(t)are integers of 1 or more for each integer t of t=0, . . . , d. Themaster key generation unit 110 also sets N₀:=1+u₀+1+w₀+z₀ andN_(t):=n_(t)+u_(t)+w_(t)+z_(t) for each integer t of t=1, . . . , d.

(2) Using the processing device, the master key generation unit 110executes the algorithm G_(bpg) taking as input the security parameterλ(1^(λ)) input in (1), and randomly generates values of parameterparam_(G):=(q, G, G_(T), g, e) of bilinear pairing groups.

(3) Using the processing device, the master key generation unit 110generates a random number ψ.

Then, the master key generation unit 110 executes the following steps(4) to (8) for each integer t of t=0, . . . , d.

(4) Using the processing device, the master key generation unit 110executes the algorithm G_(dpvs) taking as input the security parameterλ(1^(λ)) and N_(t) input in (1) and the values of param_(G):=(q, G,G_(T), g, e) generated in (2), and generates values of parameterparam_(Vt):=(q, V_(t), G_(T), A_(t), e) of dual pairing vector spaces.

(5) Using the processing device, the master key generation unit 110randomly generates a linear transformation X_(t):=(χ_(t,i,j))_(i,j)taking as input N_(t) set in (1) and F_(q). Note that GL stands forgeneral linear. That is, GL is a general linear group, a set of squarematrices with nonzero determinants, and a group under multiplication.(χ_(t,i,j))_(i,j) denotes a matrix associated with the subscripts i,j ofthe matrix χ_(t,i,j), where i, j=1, . . . , N_(t).

(6) Using the processing device and based on the random number ψ and thelinear transformation X_(t), the master key generation unit 110generates (v_(t,i,j))_(i,j):=ψ·(X_(t) ^(T))⁻¹. As in the case of(χ_(t,i,j))_(i,j), (v_(t,i,j))_(i,j) denotes a matrix associated withthe subscripts i,j of the matrix v_(t,i,j), where i, j=1, . . . , N_(t).

(7) Using the processing device and based on the linear transformationX_(t) generated in (5), the master key generation unit 110 generates thebasis B_(t) from the orthonormal basis A_(t) generated in (4).

(8) Using the processing device and based on (v_(t,i,j))_(i,j) generatedin (6), the master key generation unit 110 generates the basis B*_(t)from the orthonormal basis A_(t) generated in (4).

(9) Using the processing device, the master key generation unit 110 setse(g,g)^(ψ) in g_(T). The master key generation unit 110 also sets{param_(Vt)} _(t=0, . . . , d) generated in (4) and g_(T) in param_(n→),where g_(T)=e(b_(t,i), b*_(t,i)) for each integer t of t=0, . . . , dand each integer i of i=1, . . . , N_(t).

To summarize, in (S101), the master key generation unit 110 executes thealgorithm G_(ob) shown in Formula 129, and generates param_(n→) as wellas the basis B_(t) and the basis B*_(t) for each integer t of t=0, . . ., d.

$\begin{matrix}{{??}_{ob}( {1^{\lambda},{\overset{arrow}{n}:={{( {d;{\overset{arrow}{n}:=( {{d;n_{1}},\ldots\mspace{11mu},n_{d},u_{0},\ldots\mspace{11mu},u_{d},w_{0},\ldots\mspace{11mu},w_{d},z_{0},\ldots\mspace{11mu},z_{d}} )}} ):\mspace{79mu} N_{0}}:={1 + u_{0} + 1 + w_{0} + z_{0}}}},{N_{t}:={{n_{t} + u_{t} + w_{t} + {z_{t}\mspace{79mu}{for}\mspace{14mu} t}} = 1}},\ldots\mspace{11mu},d,\mspace{79mu}{{param}_{??}:={( {q,{??},{??}_{T},g,e} )\overset{R}{\longleftarrow}{{??}_{bpg}( 1^{\lambda} )}}},\mspace{79mu}{\psi\overset{U}{\longleftarrow}{??}_{q}^{x}},\mspace{79mu}{{{For}\mspace{14mu} t} = 0},\ldots\mspace{11mu},d,{{param}_{{??}_{t}}:={( {q,{??}_{t},{??}_{T},{??}_{t},e} ):={{??}_{dpvs}( {1^{\lambda},N_{t},{param}_{??}} )}}},\mspace{79mu}{X_{t}:={( \chi_{t,i,j} )_{i,j}\overset{U}{\longleftarrow}{{GL}( {N_{t},{??}_{q}} )}}},\mspace{14mu}\mspace{79mu}{( v_{t,{i.j}} )_{i,j}:={{\psi \cdot ( X_{t}^{T} )} - 1}},\mspace{79mu}{b_{t,i}:={{( {{\chi_{t,i,1,}\ldots}\;,\chi_{t,i,N_{t}}} ){??}_{t}} = {\sum\limits_{j = 1}^{N_{t}}\;{\chi_{t,i,j}a_{t,j}}}}},\mspace{14mu}\mspace{79mu}{{??}_{t}:=( {b_{t,1},\ldots\mspace{11mu},b_{t,N_{t}}} )},\mspace{79mu}{b_{t,i}^{*}:={{( {{v_{t,i,1,}\ldots}\mspace{11mu},v_{t,i,N_{t}}} ){??}_{t}} = {\sum\limits_{j = 1}^{N_{t}}\;{v_{t,i,j}a_{t,j}}}}},\mspace{14mu}\mspace{79mu}{{??}_{t}^{*}:=( {b_{t,1}^{*},\ldots\mspace{11mu},b_{t}^{*}{,_{N}}_{t}} )},\mspace{79mu}{g_{T}:={e( {g,g} )}^{\psi}},\;\mspace{20mu}{{param}_{\overset{arrow}{n}}:={( {\{ {param}_{{??}_{t}} \}_{{t = 0},\;\ldots\;,d,}g_{T}} )\mspace{79mu}{return}\mspace{14mu}{( {{param}_{\overset{arrow}{n}},\{ {{??}_{t},{??}_{t}^{*}} \}_{{t = 0},\;\ldots\;,d}} ).}}}} } & \lbrack {{Formula}\mspace{14mu} 129} \rbrack\end{matrix}$

(S102: Master Public Key Generation Step)

Using the processing device, the master key generation unit 110generates a partial basis B^₀ of the basis B₀ and a partial basis B^_(t)of the basis B_(t) for each integer t of t=1, . . . , d, as shown inFormula 130.

₀:=(b _(0,1) , b _(0,1+u) ₀ ₊₁ ,b _(0,1+u) ₀ _(+1+w) ₀ ₊₁ , . . . , b_(0,1+u) ₀ _(+1+w) ₀ _(+z) ₀ ),

_(t):=(b _(t,1) , . . . , b _(t,n) _(t) ,b _(t,n) _(t) _(+u) _(t) _(+w)_(t) ₊₁ , . . . , b _(t,n) _(t) _(+u) _(t) _(+w) _(t) _(+z) _(t) ) fort=1, . . . , d  [Formula 130]

The master key generation unit 110 designates, as a master public keypk, a combination of the generated partial basis B^₀ and partial basisB^_(t), the security parameter λ(1^(λ)) input in (S101), and param_(n→),the basis vectors b*_(0,1+u0+1+1), . . . , b*_(0,1+u0+1+w0) (where u0and w0 respectively denote u₀ and w₀), and the basis vectorsb*_(t,nt+ut+1), . . . , b*_(t,nt+ut+wt) (where nt, ut, and wtrespectively denote n_(t), u_(t), and w_(t)) for each integer t of t=1,. . . , d generated in (S101).

(S103: Master Secret Key Generation Step)

Using the processing device, the master key generation unit 110generates a partial basis B^*₀ of the basis B*₀ and a partial basisB^*_(t) of the basis B*_(t) for each integer t of t=1, . . . , d, asshown in Formula 131.

*₀:=(b* _(0,1) ,b* _(0,1+u) ₀ ₊₁),

*_(t):=(b* _(t,1) , . . . , b* _(t,n) _(t) ) for t=1, . . . ,d  [Formula 131]

The master key generation unit 110 designates the generated partialbasis B^*₀ and partial basis B^*_(t) as a master secret key.

(S104: Master Key Storage Step)

The master key storage unit 120 stores the master public key pkgenerated in (S102) in the storage device. The master key storage unit120 also stores the master secret key sk generated in (S103) in thestorage device.

To summarize, in (S101) to (S103), the key generation device 100executes the Setup algorithm shown in Formula 132, and generates themaster public key pk and the master secret key sk. Then, in (S104), thekey generation device 100 stores the generated master public key pk andmaster secret key sk in the storage device.

The master public key pk is made public through a network, for example,so as to be made available for the decryption device 300.

$\begin{matrix}{{{{{Setup}\mspace{11mu}( {1^{\lambda},{\overset{arrow}{n}:=( {{d;n_{1}},\ldots\;,n_{d},u_{0},\ldots\mspace{11mu},u_{d},w_{0},\ldots\mspace{11mu},w_{d},z_{0},\ldots\mspace{11mu},z_{d}} )}} )}:\mspace{79mu}{( {{param}_{\overset{harpoonup}{n}},\{ {{??}_{t},{??}_{t}^{*}} \}_{{t = 0},\;\ldots\mspace{11mu},d}} )\overset{R}{\longleftarrow}{{??}_{ob}( {1^{\lambda},\overset{arrow}{n}} )}}},{{\hat{??}}_{0}:=( {b_{0,1},b_{0,{1 + u_{0} + 1}},b_{0,{1 + u_{0} + {1w_{0}} + 1}},\ldots\;,b_{0,{1 + u_{0} + 1 + w_{0} + z_{0}}}} )},{{\hat{??}}_{t}:=( {b_{t,1},\ldots\;,b_{t,n_{t}},b_{t,{n_{t} + u_{t} + w_{t} + 1}},\ldots\mspace{11mu},b_{t,{n_{t} + u_{t} + w_{t} + z_{t}}}} )}}\mspace{14mu}\mspace{79mu}{{{{for}\mspace{14mu} t} = 1},\ldots\;,d,\mspace{79mu}{{\hat{??}}_{0}^{*}:=( {b_{0,1}^{*},b_{0,{1 + u_{0} + 1}}^{*}} )},\mspace{79mu}{{\hat{??}}_{t}^{*}:={{( {b_{t,1}^{*},\ldots\;,b_{t,n_{t}}^{*}} )\mspace{14mu}{for}\mspace{14mu} t} = 1}},\ldots\;,d,{{pk}:=( {1^{\lambda},{param}_{\overset{harpoonup}{n}},\{ {\hat{??}}_{t} \}_{{t = 0},\ldots\mspace{11mu},d},\; b_{01 + u_{0} + 1 + 1}^{*},\ldots\;,b_{0,{1 + u_{0} + 1 + w_{0}}}^{*},\{ {b_{t,{n_{t} + u_{t}},{+ 1}}^{*},\ldots\mspace{11mu},b_{t,{n_{t} + u_{t} + w_{t}}}^{*}} \}_{{t = 1},\mspace{11mu}\ldots\mspace{11mu},d}} )},\mspace{79mu}{{sk}:=\{ {\hat{??}}_{t}^{*} \}_{{t = 0},\;{\ldots\mspace{11mu} d}}},\mspace{79mu}{{return}\mspace{14mu}{pk}},{{sk}.}}} & \lbrack {{Formula}\mspace{14mu} 132} \rbrack\end{matrix}$

Referring to FIG. 13, the process of the KeyGen algorithm executed bythe key generation device 100 will now be described.

(S201: Information Input Step)

Using the input device, the information input unit 130 inputs predicateinformation (v{right arrow over ( )}₁, . . . , v{right arrow over ()}_(L)):=((v_(1,i) (i=1, . . . , n₁)), . . . , (v_(L,i) (i=1, . . . ,n_(L)))). As predicate information, an attribute of a user of a key isinput.

(S202: Random Number Generation Step)

Using the processing device, the random number generation unit 141generates a random number ψ, random numbers s_(dec,t), s_(ran,j,t) (t=1,. . . , L), random numbers θ_(dec,t), θ_(ran,j,t), η{right arrow over ()}_(dec,t), η{right arrow over ( )}_(ran,j,t) (t=0, . . . , L), randomnumbers s_(ran,(τ,ι)t), s_(del,(τ,ι),t) (t=1, . . . , L+1), and randomnumbers θ_(ran,(τ,ι),t), θ_(del,(τ,ι),t), η{right arrow over ()}_(ran,(τ,ι),t), η{right arrow over ( )}_(del,(τ,ι),t) (t=0, . . . ,L+1) for each integer j, τ, ι of j=1, . . . , 2L, τ of τ=L+1, . . . d,and (τ,ι)=(τ,1), . . . , (τ,n_(τ)), as shown in Formula 133.

$\begin{matrix}{\mspace{79mu}{{for}\mspace{79mu}{{j = 1},\ldots\mspace{14mu},{{2L};}}\mspace{79mu}{{\tau = {L + 1}},\ldots\mspace{14mu},{d;}}\mspace{79mu}{{( {\tau,l} ) = ( {\tau,1} )},\ldots\mspace{14mu},{( {\tau,n_{\tau}} );}}\mspace{79mu}{\psi,s_{{dec},t},{s_{{ran},j,t}\overset{U}{\longleftarrow}{{??}_{q}( {{t = 1},\ldots\mspace{14mu},L} )}},\mspace{79mu}\theta_{{dec},t},{\theta_{{ran},j,t}\overset{U}{\longleftarrow}{{??}_{q}( {{t = 0},\ldots\mspace{14mu},L} )}},{{\overset{->}{\eta}}_{{dec},t}:={( {\eta_{{dec},t,1},\ldots\mspace{14mu},\eta_{{dec},t,w_{t}}} )\overset{U}{\longleftarrow}{{??}_{q}^{w_{t}}( {{t = 0},\ldots\mspace{14mu},L} )}}},{{\overset{->}{\eta}}_{{ran},j,t}:={( {\eta_{{ran},j,t,1},\ldots\mspace{14mu},\eta_{{ran},j,t,w_{t}}} )\overset{U}{\longleftarrow}{{??}_{q}^{w_{t}}( {{t = 0},\ldots\mspace{14mu},L} )}}},\mspace{79mu} s_{{ran},{({\tau,l})},t},{s_{{del},{({\tau,l})},t}\overset{U}{\longleftarrow}{{??}_{q}( {{t = 1},\ldots\mspace{14mu},{L + 1}} )}},\mspace{79mu}\theta_{{ran},{({\tau,l})},t},{\theta_{{del},{({\tau,l})},t}\overset{U}{\longleftarrow}{{??}_{q}( {{t = 0},\ldots\mspace{14mu},{L + 1}} )}},{{\overset{->}{\eta}}_{{ran},{({\tau,l})},t}:={( {\eta_{{ran},{({\tau,l})},t,1},\ldots\mspace{14mu},\eta_{{ran},{({\tau,l})},t,w_{t}}} )\overset{U}{\longleftarrow}{{??}_{q}^{w_{t}}( {{t = 0},\ldots\mspace{14mu},{L + 1}} )}}},{{\overset{->}{\eta}}_{{del},{({\tau,l})},t}:={( {\eta_{{del},{({\tau,l})},t,1},\ldots\mspace{14mu},\eta_{{del},{({\tau,l})},t,w_{t}}} )\overset{U}{\longleftarrow}{{??}_{q}^{w_{t}}( {{t = 0},\ldots\mspace{14mu},{L + 1}} )}}}}}} & \lbrack {{Formula}\mspace{14mu} 133} \rbrack\end{matrix}$

Also, s_(dec,0), s_(ran,j,0), s_(ran,(τ,ι),0), and s_(del,(τ,ι),0) areset as shown in Formula 134.s _(dec,0):=Σ_(t=1) ^(L) s _(dec,t),s _(ran,j,0):=Σ_(t=1) ^(L) s _(ran,j,t),s _(ran,(τ,ι),0):=Σ_(t=1) ^(L+1) s _(ran,(τ,ι),t),s _(del,(τ,ι),0):=Σ_(t=1) ^(L+1) s _(del,(τ,ι),t)  [Formula 134]

(S203: Decryption Element Generation Step)

Using the processing device, the decryption element generation unit 142generates a decryption element k*_(L,dec) which is an element of adecryption key sk_(L), as shown in Formula 135.k* _(L,dec):=((−s _(dec,0),0^(u) ⁰ ,1,{right arrow over(η)}_(dec,0),0^(z) ⁰

, (s _(dec,t) {right arrow over (e)} _(t,1)+θ_(dec,t) {right arrow over(v)} _(t),0^(u) ^(t) ,{right arrow over (η)}_(dec,t),0^(z) ^(t)

:t=1, . . . , L)  [Formula 135]

As described above, for the basis B and the basis B* shown in Formula110, Formula 111 is defined. Thus, Formula 135 denotes that coefficientsof basis vectors of the basis B*₀ and the basis B*_(t) (t=1, . . . , L)are set as described below to generate the decryption elementk*_(L,dec).

First, description will be directed to the basis B*₀. For simplicity ofnotation, a basis vector b*_(0,i) is identified using only the iportion. For example, a basis vector 1 denotes a basis vector b*_(0,1).Basis vectors 1, . . . , 3 denote basis vectors b*_(0,1), . . . ,b*_(0,3).

−s_(dec,0) is set as a coefficient of a basis vector 1 of the basis B*₀.0 is set as a coefficient of each of basis vectors 1+1, . . . , 1+u₀. 1is set as a coefficient of a basis vector 1+u₀+1. η_(dec,0,1), . . . ,η_(dec,0,w0) (where w0 denotes w₀) are respectively set as coefficientsof basis vectors 1+u₀+1+1, . . . , 1+u₀+1+w₀. 0 is set as a coefficientof each of basis vectors 1+u₀+1+w₀+1, . . . , 1+u₀+1+w₀+z₀.

Next, description will be directed to the basis B*_(t) (t=1, . . . , L).For simplicity of notation, a basis vector b*_(t,i) is identified usingonly the i portion. For example, a basis vector 1 denotes a basis vectorb*_(t,1). Basis vectors 1, . . . , 3 denote basis vectors b*_(t,1), . .. , b*_(t,3).

s_(dec,t)+θ_(dec,t)v_(t,1) is set as a coefficient of a basis vector 1of the basis B*_(t) (t=1, . . . , L). θ_(dec,t)v_(t,2), . . . ,θ_(dec,t)v_(t,nt) (where nt denotes n_(t)) are respectively set ascoefficients of basis vectors 2, . . . , n_(t). 0 is set as acoefficient of each of basis vectors n_(t)+1, . . . , n_(t)+u_(t).η_(dec,t,1), . . . , η_(dec,t,wt) (where wt denotes w_(t)) arerespectively set as coefficients of basis vectors n_(t)+u_(t)+1, . . . ,n_(t)+u_(t)+w_(t). 0 is set as a coefficient of each of basis vectorsn_(t)+u_(t)+w_(t)+1, . . . , n_(t)+u_(t)+w_(t)+z_(t).

(S204: First Randomizing Element Generation Step)

Using the processing device, the randomizing element generation unit 143generates a first randomizing element k*_(L,ran,j) which is an elementof the decryption key sk_(L), for each integer j of j=1, . . . , 2L, asshown in Formula 136.k* _(L,ran,j):=((−s _(ran,j,0),0^(u) ⁰ ,0,{right arrow over(η)}_(ran,j,0),0^(z) ⁰

, (s _(ran,j,t) {right arrow over (e)} _(t,1)+θ_(ran,j,t) {right arrowover (v)} _(t),0^(u) ^(t) ,{right arrow over (η)}_(ran,j,t),0^(z) ^(t)

:t=1, . . . , L)  [Formula 136]

As described above, for the basis B and the basis B* shown in Formula110, Formula 111 is defined. Thus, Formula 136 denotes that coefficientsof basis vectors of the basis B*₀ and the basis B*_(t) (t=1, . . . , L)are set as described below to generate the first randomizing elementk*_(L,ran,j).

First, description will be directed to the basis B*₀. For simplicity ofnotation, a basis vector b*_(0,i) is identified using only the iportion. For example, a basis vector 1 denotes a basis vector b*_(0,1).Basis vectors 1, . . . , 3 denote basis vectors b*_(0,1), . . . ,b*_(0,3).

−s_(ran,j,0) is set as a coefficient of a basis vector 1 of the basisB*₀. 0 is set as a coefficient of each of basis vectors 1+1, . . . ,1+u₀+1. η_(ran,j,0,1), . . . , η_(ran,j,0,w0) (where w0 denotes w₀) arerespectively set as coefficients of basis vectors 1+u₀+1+1, . . . ,1+u₀+1+w₀. 0 is set as a coefficient of each of basis vectors1+u₀+1+w₀+1, . . . , 1+u₀+1+w₀+z₀.

Next, description will be directed to the basis B*_(t) (t=1, . . . , L).For simplicity of notation, a basis vector b*_(t,i) is identified usingonly the i portion. For example, a basis vector 1 denotes a basis vectorb*_(t,1). Basis vectors 1, . . . , 3 denote basis vectors b*_(t,1), . .. , b*_(t,3).

s_(ran,j,t)+θ_(ran,j,t)v_(t,1) is set as a coefficient of a basis vector1 of the basis B*_(t) (t=1, . . . , L). θ_(ran,j,t)v_(t,2), . . . ,θ_(ran,j,t)v_(t,nt) (where nt denotes n_(t)) are respectively set ascoefficients of basis vectors 2, . . . , n_(t). 0 is set as acoefficient of each of basis vectors n_(t)+1, . . . , n_(t)+u_(t).η_(ran,j,t,1), . . . , η_(ran,j,t,wt) (where wt denotes w_(t)) arerespectively set as coefficients of basis vectors n_(t)+u_(t)+1, . . . ,n_(t)+u_(t)+w_(t). 0 is set as a coefficient of each of basis vectorsn_(t)+u_(t)+w_(t)+1, . . . , n_(t)+u_(t)+w_(t)+z_(t).

(S205: Second Randomizing Element Generation Step)

Using the processing device, the randomizing element generation unit 143generates a second randomizing element k*_(L,ran,(τ,ι)) which is anelement of the decryption key sk_(L), for each integer τ of τ=L+1, . . ., d and each integer ι of ι=1, . . . , n_(t) with respect to eachinteger τ, as shown in Formula 137.k* _(L,ran,(τ,ι)):=((−s _(ran,(τ,ι),0),0^(u) ⁰ ,0,{right arrow over(η)}_(ran,(τ,ι),0),0^(z) ⁰

, (s _(ran,(τ,ι),t) {right arrow over (e)} _(t,1)+θ_(ran,(τ,ι),t) {rightarrow over (v)} _(t),0^(u) ^(t) ,{right arrow over(η)}_(ran,(τ,ι),t),0^(z) ^(t)

:t=1, . . . , L(s _(ran,(τ,ι),L+1) {right arrow over (e)} _(τ,1),0^(u)^(τ) ,{right arrow over (η)}_(ran,(τ,ι),L+1),0^(z) ^(τ)

)  [Formula 137]

As described above, for the basis B and the basis B* shown in Formula110, Formula 111 is defined. Thus, Formula 137 denotes that coefficientsof basis vectors of the basis B*₀, the basis B*_(t) (t=1, . . . , L),and a basis B*_(τ) are set as described below to generate the secondrandomizing element k*_(L,ran,(τ,ι)).

First, description will be directed to the basis B*₀. For simplicity ofnotation, a basis vector b*_(0,i) is identified using only the iportion. For example, a basis vector 1 denotes a basis vector b*_(0,1).Basis vectors 1, . . . , 3 denote basis vectors b*_(0,1), . . . ,b*_(0,3).

−s_(ran,(τ,ι),0) is set as a coefficient of a basis vector 1 of thebasis B*₀. 0 is set as a coefficient of each of basis vectors 1+1, . . ., 1+u₀+1. η_(ran,(τ,ι),0,1), . . . , η_(ran,(τ,ι),0,w0) (where w0denotes w₀) are respectively set as coefficients of basis vectors1+u₀+1+1, . . . , 1+u₀+1+w₀. 0 is set as a coefficient of each of basisvectors 1+u₀+1+w₀+1, . . . , 1+u₀+1+w₀+z₀.

Next, description will be directed to the basis B*_(t) (t=1, . . . , L).For simplicity of notation, a basis vector b*_(t,i) is identified usingonly the i portion. For example, a basis vector 1 denotes a basis vectorb*_(t,1). Basis vectors 1, . . . , 3 denote basis vectors b*_(t,1), . .. , b*_(t,3).

s_(ran,(τ,ι),t)+θ_(ran,(τ,ι),t)v_(t,1) is set as a coefficient of abasis vector 1 of the basis B*_(t) (t=1, . . . , L).θ_(ran,(τ,ι),t)v_(t,2), . . . , θ_(ran,(τ,ι),t)v_(t,nt) (where ntdenotes n_(t)) are respectively set as coefficients of basis vectors 2,. . . , n_(t). 0 is set as a coefficient of each of basis vectorsn_(t)+1, . . . , n_(t)+u_(t). η_(ran,(τ,ι),t,1), . . . ,η_(ran,(τ,ι),t,wt) (where wt denotes w_(t)) are respectively set ascoefficients of basis vectors n_(t)+u_(t)+1, . . . , n_(t)+u_(t)+w_(t).0 is set as a coefficient of each of basis vectors n_(t)+u_(t)+w_(t)+1,. . . , n_(t)+u_(t)+w_(t)+z_(t).

Next, description will be directed to the basis B*_(τ). For simplicityof notation, a basis vector b*_(τ,i) is identified using only the iportion. For example, a basis vector 1 denotes a basis vector b*_(τ,1).Basis vectors 1, . . . , 3 denote basis vectors b*_(τ,1), . . . ,b*_(τ,3).

s_(ran,(τ,ι),L+)1 is set as a coefficient of a basis vector 1 of thebasis B*_(τ). 0 is set as a coefficient of each of basis vectors 2, . .. , n_(τ), . . . n_(τ)+u_(τ). η_(ran,(τ,ι),L+1,1), . . . ,η_(ran,(τ,ι),L+1,wτ) (where wτ denotes w_(t)) are respectively set ascoefficients of basis vectors n_(τ)+u_(τ)+1, . . . , n_(τ)+u_(τ)+w_(τ).0 is set as a coefficient of each of basis vectors n_(τ)+u_(τ)+w_(τ)+1,. . . , n_(τ)+u_(τ)+w_(τ)+z_(τ).

(S206: Delegation Element Generation Step)

Using the processing device, the delegation element generation unit 144generates a delegation element k*_(L,del,(τ,ι)) which is an element ofthe decryption key sk_(L), for each integer τ of τ=L+1, . . . , d andeach integer ι of ι=1, . . . , n_(τ) with respect to each integer τ, asshown in Formula 138.k* _(L,del,(τ,ι)):=((−s_(del,(τ,ι),0),0^(u) ⁰ ,0,{right arrow over(η)}_(del,(τ,ι),0),0^(z) ⁰

, (s _(del,(τ,ι),t) {right arrow over (e)} _(t,1)+θ_(del,(τ,ι),t) {rightarrow over (v)} _(t),0^(u) ^(t) ,{right arrow over(η)}_(del,(τ,ι),t),0^(z) ^(t)

:t=1, . . . , L(s _(del,(τ,ι),L+1) {right arrow over (e)} _(τ,1)+ψ{right arrow over (e)} _(τ,ι),0^(u) ^(τ) ,{right arrow over(η)}_(del,(τ,ι),L+1),0^(z) ^(τ)

)  [Formula 138]

As described above, for the basis B and the basis B* shown in Formula110, Formula 111 is defined. Thus, Formula 138 denotes that coefficientsof basis vectors of the basis B*₀ and the basis B*_(t) (t=1, . . . , L)are set as described below to generate the delegation elementk*_(L,del,(τ,ι)).

First, description will be directed to the basis B*₀. For simplicity ofnotation, a basis vector b*_(0,i) is identified using only the iportion. For example, a basis vector 1 denotes a basis vector b*_(0,1).Basis vectors 1, . . . , 3 denote basis vectors b*_(0,1), . . . ,b*_(0,3).

−s_(del,(τ,ι),0) is set as a coefficient of a basis vector 1 of thebasis B*₀. 0 is set as a coefficient of each of basis vectors 1+1, . . ., 1+u₀+1. η_(del,(τ,ι),0,1), . . . , η_(del,(τ,ι),0,w0) (where w0denotes w₀) are respectively set as coefficients of basis vectors1+u₀+1+1, . . . , 1+u₀+1+w₀. 0 is set as a coefficient of each of basisvectors 1+u₀+1+w₀+1, . . . , 1+u₀+1+w₀+z₀.

Next, description will be directed to the basis B*_(t) (t=1, . . . , L).For simplicity of notation, a basis vector b*_(t,i) is identified usingonly the i portion. For example, a basis vector 1 denotes a basis vectorb*_(t,1). Basis vectors 1, . . . , 3 denote basis vectors b*_(t,1), . .. , b*_(t,3).

s_(del,(τ,ι),t)+θ_(del,(τ,ι),t)v_(t,1) is set as a coefficient of abasis vector 1 of the basis B*_(t) (t=1, . . . , L).θ_(del,(τ,ι),t)v_(t,2), . . . , θ_(del,(τ,ι),t)v_(t,nt) (where ntdenotes n_(t)) are respectively set as coefficients of basis vectors 2,. . . , n_(t). 0 is set as a coefficient of each of basis vectorsn_(t)+1, . . . , n_(t)+u_(t). η_(del,(τ,ι),t,1), . . . ,η_(del,(τ,ι),t,wt) (where wt denotes w_(t)) are respectively set ascoefficients of basis vectors n_(t)+u_(t)+1, . . . , n_(t)+u_(t)+w_(t).0 is set as a coefficient of each of basis vectors n_(t)+u_(t)+w_(t)+1,. . . , n_(t)+u_(t)+w_(t)+z_(t).

Next, description will be directed to the basis B*_(τ). For simplicityof notation, a basis vector b*_(τ,i) is identified using only the iportion. For example, a basis vector 1 denotes a basis vector b*_(τ,1).Basis vectors 1, . . . , 3 denote basis vectors b*_(τ,1), . . . ,b*_(τ,3).

s_(del,(τ,ι),L+1)e{right arrow over ( )}_(τ,1)+ψe{right arrow over ()}_(τ,ι) is set as a coefficient of each of basis vectors 1, . . . ,n_(τ) of the basis B*_(τ). 0 is set as a coefficient of each of basisvectors n_(τ)+1, . . . , n_(τ)+u_(τ). η_(del,(τ,ι),L+1,1), . . . ,η_(del,(τ,ι),L+1,wτ) (where wτ denotes w_(τ)) are respectively set ascoefficients of basis vectors n_(τ)+u_(τ)+1, . . . , n_(τ)+u_(τ)+w_(τ).0 is set as a coefficient of each of basis vectors n_(τ)+u_(τ)+w_(τ)+1,. . . , n_(τ)+u_(τ)+w_(τ)+z_(τ).

(S207: Key Distribution Step)

Using the communication device and through the network, for example, thekey distribution unit 150 secretly provides to the decryption device 300the decryption key sk_(L) having elements of the decryption elementk*_(L,dec), the first randomizing element k*_(L,ran,j) (j=1, . . . ,2L), the second randomizing element k*_(L,ran,(τ,ι)) (τ=L+1, . . . , d;(τ,ι)=(τ,1), . . . , (τ,n_(τ))), and the delegation elementk*_(L,del,(τ,ι)) (τ=L+1, . . . , d; (τ,ι)=(τ,1), . . . , (τ,n_(τ))). Itis obvious that the decryption key sk_(L) may be provided to thedecryption device 300 by other methods.

To summarize, in (S201) to (S206), the key generation device 100executes the KeyGen algorithm shown in Formulas 139 and 140, andgenerates the decryption key sk_(L). Then, in (S207), the key generationdevice 100 provides the generated decryption key sk_(L) to thedecryption device 300.

$\begin{matrix}{{{KeyGen}( {{pk},{sk},{( {{\overset{->}{v}}_{1},\ldots\mspace{14mu},{\overset{->}{v}}_{L}} ):=( {v_{1,1},\ldots\mspace{14mu},v_{1,n_{1}}} )},\ldots\mspace{14mu},( {v_{L,1},\ldots\mspace{14mu},v_{L,n_{L}}} )} )}:} & \lbrack {{Formula}\mspace{14mu} 139} \rbrack \\{\mspace{11mu}{{for}\mspace{79mu}{{j = 1},\ldots\mspace{14mu},{{2L};}}\mspace{79mu}{{\tau = {L + 1}},\ldots\mspace{14mu},{d;}}\mspace{79mu}{{( {\tau,l} ) = ( {\tau,1} )},\ldots\mspace{14mu},{( {\tau,n_{\tau}} );\mspace{79mu}\psi},s_{{dec},t},{{{s_{{ran},j,t}\overset{U}{\longleftarrow}{??}_{q}}\mspace{14mu}( {{t = 1},\ldots\mspace{14mu},L} )};}}}} & \; \\{\theta_{{dec},t},{\theta_{{ran},j,t}\overset{U}{\longleftarrow}{??}_{q}},{\overset{->}{\eta}}_{{dec},t},{{{{\overset{->}{\eta}}_{{ran},j,t}\overset{U}{\longleftarrow}{??}_{q}^{w_{t}}}\mspace{14mu}( {{t = 0},\ldots\mspace{14mu},L} )};}} & \; \\{s_{{ran},{({\tau,l})},t},{{{s_{{del},{({\tau,l})},t}\overset{U}{\longleftarrow}{??}_{q}}\mspace{14mu}( {{t = 1},\ldots\mspace{14mu},{L + 1}} )};}} & \; \\{\theta_{{ran},{({\tau,l})},t},{\theta_{{del},{({\tau,l})},t}\overset{U}{\longleftarrow}{??}_{q}},{\overset{->}{\eta}}_{{ran},{({\tau,l})},t},{{\overset{->}{\eta}}_{{del},{({\tau,l})},t}\overset{U}{\longleftarrow}{??}_{q}^{w_{t}}},{( {{t = 0},\ldots\mspace{14mu},{L + 1}} );}} & \; \\{{s_{{dec},0}:={\sum\limits_{t = 1}^{L}s_{{dec},t}}},{s_{{ran},j,0}:={\sum\limits_{t = 1}^{L}s_{{ran},j,t}}},} & \; \\{{s_{{ran},{({\tau,l})},0}:={\sum\limits_{t = 1}^{L + 1}s_{{ran},{({\tau,l})},t}}},{s_{{del},{({\tau,l})},0}:={\sum\limits_{t = 1}^{L + 1}s_{{del},{({\tau,l})},t}}},} & \; \\{{k_{L,{dec}}^{*}:=( {( {{- s_{{dec},0}},0^{u_{0}},1,{\overset{->}{\eta}}_{{dec},0},0^{z_{0}}} )_{{??}_{0}^{*}},{{( {{{s_{{dec},t}{\overset{->}{e}}_{t,1}} + {\theta_{{dec},t}{\overset{->}{v}}_{t}}},0^{u_{t}},{\overset{->}{\eta}}_{{dec},t},0^{z_{t}}} )_{{??}_{t}^{*}}:t} = 1},\ldots\mspace{14mu},L} )},} & \lbrack {{Formula}\mspace{14mu} 140} \rbrack \\{{k_{L,{ran},j}^{*}:=( {( {{- s_{{ran},j,0}},0^{u_{0}},0,{\overset{->}{\eta}}_{{ran},j,0},0^{z_{0}}} )_{{??}_{0}^{*}},{{( {{{s_{{ran},j,t}{\overset{->}{e}}_{t,1}} + {\theta_{{ran},j,t}{\overset{->}{v}}_{t}}},0^{u_{t}},{\overset{->}{\eta}}_{{ran},j,t},0^{z_{t}}} )_{{??}_{t}^{*}}:t} = 1},\ldots\mspace{14mu},L} )},} & \; \\{{{k_{L,{ran},{({\tau,l})}}^{*}:=( {( {{- s_{{ran},{({\tau,l})},0}},0^{u_{0}},0,{\overset{->}{\eta}}_{{ran},{({\tau,l})},0},0^{z_{0}}} )_{{??}_{0}^{*}},{{( {{{s_{{ran},{({\tau,l})},t}{\overset{->}{e}}_{t,1}} + {\theta_{{ran},{({\tau,l})},t}{\overset{->}{v}}_{t}}},0^{u_{t}},{\overset{->}{\eta}}_{{ran},{({\tau,l})},t},0^{z_{t}}} )_{{??}_{t}^{*}}:t} = 1},\ldots\mspace{14mu},{L( {{s_{{ran},{({\tau,l})},{L + 1}}{\overset{->}{e}}_{\tau,1}},{\overset{->}{\eta}}_{{ran},{({\tau,l})},{L + 1}},0^{z_{\tau}}} )}_{{??}_{\tau}^{*}}} )},}\mspace{11mu}} & \; \\{{k_{L,{del},{({\tau,l})}}^{*}:=( {( {{- s_{{del},{({\tau,l})},0}},0^{u_{0}},0,{\overset{->}{\eta}}_{{del},{({\tau,l})},0},0^{z_{0}}} )_{{??}_{0}^{*}},{{( {{{s_{{del},{({\tau,l})},t}{\overset{->}{e}}_{t,1}} + {\theta_{{del},{({\tau,l})},t}{\overset{->}{v}}_{t}}},0^{u_{t}},{\overset{->}{\eta}}_{{del},{({\tau,l})},t},0^{z_{t}}} )_{{??}_{t}^{*}}:t} = 1},\ldots\mspace{14mu},{L( {{{s_{{del},{({\tau,l})},{L + 1}}{\overset{->}{e}}_{\tau,1}} + {\psi{\overset{->}{e}}_{\tau,l}}},0^{u_{\tau}},{\overset{->}{\eta}}_{{del},{({\tau,l})},{L + 1}},0^{z_{\tau}}} )}_{{??}_{\tau}^{*}}} )},} & \; \\{{{sk}_{L}:=( {k_{L,{dec}}^{*},\{ k_{L,{ran},j}^{*} \}_{{j = 1},\mspace{11mu}\ldots\mspace{14mu},{2L}},\{ k_{L,{ran},{({\tau,l})}}^{*} \}_{{\tau = {L + 1}},\mspace{11mu}\ldots\mspace{14mu},{d;{{({\tau,l})} = {({\tau,1})}}},\mspace{11mu}\ldots\mspace{14mu},{({\tau,n_{\tau}})}},\{ k_{L,{del},{({\tau,l})}}^{*} \}_{{\tau = {L + 1}},\mspace{11mu}\ldots\mspace{14mu},{d;{{({\tau,l})} = {({\tau,l})}}},\mspace{11mu}\ldots\mspace{14mu},{({\tau,n_{\tau}})}}} )},} & \; \\{{return}\mspace{14mu}{{sk}_{L}.}} & \;\end{matrix}$

The functions and operations of the encryption device 200 will bedescribed.

As shown in FIG. 9, the encryption device 200 includes a master publickey acquisition unit 210, an information input unit 220 (secondinformation input unit), a ciphertext generation unit 230, and a datatransmission unit 240.

The information input unit 220 includes an attribute information inputunit 221 and a message input unit 222. The ciphertext generation unit230 includes a random number generation unit 231, a ciphertext c1generation unit 232, and a ciphertext c2 generation unit 233.

Referring to FIG. 14, the process of the Enc algorithm executed by theencryption device 200 will be described.

(S301: Master Public Key Acquisition Step)

Using the communication device and through the network, for example, themaster public key acquisition unit 210 obtains the master public key pkgenerated by the key generation device 100.

(S302: Information Input Step)

Using the input device, the attribute information input unit 221 inputsattribute information (x{right arrow over ( )}₁, . . . , x{right arrowover ( )}_(L)):=((x_(1,i) (i=1, . . . , n₁)), . . . , (x_(L,i) (i=1, . .. , n_(L)))). As attribute information, an attribute of a person who candecrypt an encrypted message is input.

Using the input device, the message input unit 222 inputs a message m tobe encrypted.

(S303: Random Number Generation Step)

Using the processing device, the random number generation unit 231generates random numbers (x^_(L+1), . . . , x{right arrow over ()}_(d)):=((x_(L+1,i) (i=1, . . . , n_(L+1))), . . . , (x_(d,i) (i=1, . .. , n_(d)))) and random numbers ω, ζ, φ{right arrow over ( )}_(t) (t=0,. . . , d), as shown in Formula 141.

$\begin{matrix}{{( {{\overset{->}{x}}_{L + 1},\ldots\mspace{14mu},{\overset{->}{x}}_{d}} ):={{( {( {x_{{L + 1},1},\ldots\mspace{14mu},x_{{L + 1},n_{L + 1}}} ),\ldots\mspace{14mu},( {x_{d,1},\ldots\mspace{14mu},x_{d,n_{d}}} )} )\overset{U}{\longleftarrow}{??}_{q}^{n_{L + 1}}} \times \ldots \times {??}_{q}^{n_{d}}}},\mspace{79mu}\omega,{\zeta\overset{U}{\longleftarrow}{??}_{q}},\mspace{45mu}\mspace{79mu}{{\overset{->}{\varphi}}_{t}:={( {\varphi_{t,1},\ldots\mspace{14mu},\varphi_{t,z_{t}}} )\overset{U}{\longleftarrow}{{??}_{q}^{z_{t}}( {{t = 0},\ldots\mspace{14mu},d} )}}}} & \lbrack {{Formula}\mspace{14mu} 141} \rbrack\end{matrix}$

(S304: Ciphertext c1 Generation Step)

Using the processing device, the ciphertext c1 generation unit 232generates a ciphertext c₁ which is an element of a ciphertext ct, asshown in Formula 142.c ₁:=((ω,0^(u) ⁰ ,ζ,0^(w) ⁰ ,{right arrow over (φ)}₀

,(ω{right arrow over (x)} _(t),0^(u) ^(t) ,0^(w) ^(t) ,{right arrow over(φ)}_(t)

:t=1, . . . , d)  [Formula 142]

As described above, for the basis B and the basis B* shown in Formula110, Formula 111 is defined. Thus, Formula 142 denotes that coefficientsof basis vectors of the basis B₀ and the basis B_(t) (t=1, . . . , d)are set as described below to generate the ciphertext c₁.

First, description will be directed to the basis B₀. For simplicity ofnotation, a basis vector b_(0,i) is identified using only the i portion.For example, a basis vector 1 denotes a basis vector b_(0,1). Basisvectors 1, . . . , 3 denote basis vectors b_(0,1), . . . , b_(0,3).

ω is set as a coefficient of a basis vector 1 of the basis B₀. 0 is setas a coefficient of each of basis vectors 1+1, . . . , 1+u₀. ζ is set asa coefficient of a basis vector 1+u₀+1. 0 is set as a coefficient ofeach of basis vectors 1+u₀+1+1, . . . , 1+u₀+1+w₀. φ_(0,1), . . . ,φ_(0,z0) (where z0 denotes z₀) are respectively set as coefficients ofbasis vectors 1+u₀+1+w₀+1, . . . , 1+u₀+1+w₀+z₀.

Next, description will be directed to the basis B_(t) (t=1, . . . , d).For simplicity of notation, a basis vector b_(t,i) is identified usingonly the i portion. For example, a basis vector 1 denotes a basis vectorb_(t,1). Basis vectors 1, . . . , 3 denote basis vectors b_(t,1), . . ., b_(t,3).

ωx_(t,1), . . . , ωx_(t,nt) (where nt denotes n_(t)) are respectivelyset as coefficients of basis vectors 1, . . . , n_(t) of the basis B_(t)(t=1, . . . , d). 0 is set as a coefficient of each of basis vectorsn_(t)+1, . . . , n_(t)+u_(t)+w_(t). φ_(t,1), . . . , φ_(t,zt) (where ztdenotes z_(t)) are respectively set as coefficients of basis vectorsn_(t)+u_(t)+w_(t)+1, . . . , n_(t)+u_(t)+w_(t)+z_(t).

(S305: Ciphertext c2 Generation Step)

Using the processing device, the ciphertext c2 generation unit 233generates a ciphertext c₂ which is an element of the ciphertext ct, asshown in Formula 143.c₂:=g_(T) ^(ζ)m  [Formula 143]

(S306: Data Transmission Step)

Using the communication device and through the network, for example, thedata transmission unit 240 transmits to the decryption device 300 theciphertext ct including the ciphertext c₁ and the ciphertext c₂. It isobvious that the ciphertext ct may be transmitted to the decryptiondevice 300 by other methods.

To summarize, in (S301) to (S305), the encryption device 200 executesthe Enc algorithm shown in Formula 144, and generates the ciphertext ct.Then, in (S306), the encryption device 200 transmits the generatedciphertext ct to the decryption device 300.

$\begin{matrix}{{Enc}( {{pk},{m \in {??}_{T}},{{( {{\overset{->}{x}}_{1},\ldots\mspace{14mu},{\overset{->}{x}}_{L}} ):={( {( {x_{1,1},\ldots\mspace{14mu},x_{1,n_{1}}} ),\ldots\mspace{14mu},( {x_{L,1},\ldots\mspace{14mu},x_{L,n_{L}}} )} ):\mspace{79mu}{{( {{\overset{->}{x}}_{L + 1},\ldots\mspace{14mu},{\overset{->}{x}}_{d}} )\overset{U}{\longleftarrow}{??}_{q}^{n_{L + 1}}} \times \ldots \times {??}_{q}^{n_{d}}}}};\mspace{79mu}\omega},{\zeta\overset{U}{\longleftarrow}{??}_{q}},{{\overset{->}{\varphi}}_{t}\overset{U}{\longleftarrow}{{??}_{q}^{z_{t}}( {{t = 0},\ldots\mspace{14mu},d} )}},{c_{1}:=( {( {\omega,0^{u_{0}},\zeta,0^{w_{0}},{\overset{->}{\varphi}}_{0}} )_{{??}_{0}},{{( {{\omega\;{\overset{->}{x}}_{t}},0^{u_{t}},0^{w_{t}},{\overset{->}{\varphi}}_{t}} )_{{??}\; t}:t} = 1},\ldots\mspace{14mu},d} )},\mspace{79mu}{c_{2}:={g_{T}^{\zeta}m}},\mspace{79mu}{{ct}:=( {c_{1},c_{2}} )},\mspace{79mu}{{return}\mspace{14mu}{{ct}.}}} } & \lbrack {{Formula}\mspace{14mu} 144} \rbrack\end{matrix}$

The functions and operations of the decryption device 300 will bedescribed.

As shown in FIG. 10, the decryption device 300 includes a decryption keyacquisition unit 310, a data receiving unit 320, a pairing operationunit 330, and a message computation unit 340.

Referring to FIG. 15, the process of the Dec algorithm executed by thedecryption device 300 will be described.

(S401: Decryption Key Acquisition Step)

Using the communication device and through the network, for example, thedecryption key acquisition unit 310 obtains the decryption key sk_(L).The decryption key acquisition unit 310 also obtains the master publickey pk generated by the key generation device 100.

(S402: Data Receiving Step)

Using the communication device and through the network, for example, thedata receiving unit 320 receives the ciphertext ct transmitted by theencryption device 200.

(S403: Pairing Operation Step)

Using the processing device, the pairing operation unit 330 performs apairing operation shown in Formula 145, and computes a session keyK=g_(T) ^(ζ).K:=e(c ₁ ,k* _(L,dec))  [Formula 145]

If the inner product of (v{right arrow over ( )}₁, . . . , v{right arrowover ( )}_(L)) and (x{right arrow over ( )}₁, . . . , x{right arrow over( )}_(L)) is 0, the session key K is computed by computing Formula 145.

(S404: Message Computation Step)

Using the processing device, the message computation unit 340 computes amessage m′(=m) by dividing the ciphertext c2 by the session key K.

To summarize, in (S401) to (S404), the decryption device 300 executesthe Dec algorithm shown in Formula 146, and computes the message m′(=m).Dec(pk,k* _(L,dec) ,ct):m′:=c ₂ /e(c ₁ ,k* _(L,dec)) returnm′.  [Formula 146]

The functions and operations of the key delegation device 400 will bedescribed.

As shown in FIG. 11, the key delegation device 400 includes a decryptionkey acquisition unit 410, an information input unit 420 (thirdinformation input unit), a delegation key generation unit 430, and a keydistribution unit 440 (delegation key transmission unit).

The delegation key generation unit 430 includes a random numbergeneration unit 431, a lower-level decryption element generation unit432, a lower-level randomizing element generation unit 433, and alower-level delegation element generation unit 434.

Referring to FIG. 16, the process of the Delegate_(L) algorithm executedby the key delegation device 400 will be described.

(S501: Decryption Key Acquisition Step)

Using the communication device and through the network, for example, thedecryption key acquisition unit 410 obtains the decryption key sk_(L).The decryption key acquisition unit 410 also obtains the master publickey pk generated by the key generation device 100.

(S502: Information Input Step)

Using the input device, the information input unit 420 inputs predicateinformation v{right arrow over ( )}_(L+1)=(v_(L+1,i) (i=1, . . . ,n_(L+1))). As predicate information, an attribute of a person to whomthe key is delegated is input.

(S503: Random Number Generation Step)

Using the processing device, the random number generation unit 431generates random numbers α_(dec,j), σ_(dec), α_(ran,j′,j), σ_(ran,j′),α_(ran,(τ,ι),j), σ_(ran,(τ,ι)), φ_(ran,(τ,ι)), α_(del,(τ,ι),j),σ_(del,(τ,ι)), φ_(del,(τ,ι)), ψ′, η_(dec,(t,i)), η_(ran,j′,(t,i)),η_(ran,(τ,ι,(t,i)), η_(del,(τ,ι),(t,i)) for each integer j, j′, τ, ι, t,i of j=1, . . . , 2L, j′=1, . . . , 2(L+1), τ=L+2, . . . , d,(τ,ι)=(τ,1), . . . , (τ,n_(τ)), t=0, . . . , L+1, τ, (t,i)=(t,1), . . ., (t,n_(t)), as shown in Formula 147.

$\begin{matrix}{{{for}{j = 1},\ldots\mspace{14mu},{{2L};}}{{j^{\prime} = 1},\ldots\mspace{14mu},{{2( {L + 1} )};}}{{\tau = {L + 2}},\ldots\mspace{14mu},{d;}}{{( {\tau,l} ) = ( {\tau,1} )},\ldots\mspace{14mu},{( {\tau,n_{\tau}} );}}{{t = 0},\ldots\mspace{14mu},{L + 1},{\tau;}}{{( {t,i} ) = ( {t,1} )},\ldots\mspace{14mu},{( {t,w_{t}} );}}{\alpha_{{dec},j},\sigma_{dec},\alpha_{{ran},j^{\prime},j},\sigma_{{ran},j^{\prime}},\alpha_{{ran},{({\tau,l})},j},\sigma_{{ran},{({\tau,l})}},\phi_{{ran},{({\tau,l})}},\alpha_{{del},{({\tau,l})},j},\sigma_{{del},{({\tau,l})}},\phi_{{del},{({\tau,l})}},\psi^{\prime},\eta_{{dec},{({t,i})}},\eta_{{ran},j^{\prime},{({t,i})}},\eta_{{ran},{({\tau,l})},{({t,i})}},{\eta_{{del},{({\tau,l})},{({t,i})}}\overset{U}{\longleftarrow}{??}_{q}}}} & \lbrack {{Formula}\mspace{14mu} 147} \rbrack\end{matrix}$

(S504: Lower-Level Decryption Element Generation Step)

Using the processing device, the lower-level decryption elementgeneration unit 432 generates a lower-level decryption elementk*_(L+1,dec) which is an element of a delegation key sk_(L+1), as shownin Formula 148.

$\begin{matrix}{k_{{L + 1},{dec}}^{*}:={k_{L,{dec}}^{*} + {\sum\limits_{j = 1}^{2L}{\alpha_{{dec},j}k_{L,{ran},j}^{*}}} + {\sigma_{dec}( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i})}}^{*}}} )} + {\sum\limits_{i = 1}^{w_{i}}{\eta_{{dec},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{dec},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}}}} & \lbrack {{Formula}\mspace{14mu} 148} \rbrack\end{matrix}$

(S505: First Lower-Level Randomizing Element Generation Step)

Using the processing device, the lower-level randomizing elementgeneration unit 433 generates a first lower-level randomizing elementk*_(L+1,ran,j′) which is an element of the delegation key sk_(L+1), foreach integer j′ of j′=1, . . . , 2(L+1), as shown in Formula 149.

$\begin{matrix}{k_{{L + 1},{ran},j^{\prime}}^{*}:={{\sum\limits_{j = 1}^{2L}{\alpha_{{ran},j^{\prime},j}k_{L,{ran},j}^{*}}} + {\sigma_{{ran},j^{\prime}}( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i})}}^{*}}} )} + {\sum\limits_{i = 1}^{w_{t}}{\eta_{{ran},j^{\prime},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{ran},j^{\prime},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}}}} & \lbrack {{Formula}\mspace{14mu} 149} \rbrack\end{matrix}$

(S506: Second Lower-Level Randomizing Element Generation Step)

Using the processing device, the lower-level randomizing elementgeneration unit 433 generates a second lower-level randomizing elementk*_(L+1,ran,(τ,ι)) which is an element of the delegation key sk_(L+1),for each integer τ of τ=L+2, . . . , d and each integer ι of ι=1, . . ., n_(τ) with respect to each integer τ, as shown in Formula 150.

$\begin{matrix}{k_{{L + 1},{ran},{({\tau,l})}}^{*}:={{\sum\limits_{j = 1}^{2L}{\alpha_{{ran},{({\tau,l})},j}k_{L,{ran},j}^{*}}} + {\sigma_{{ran},{({\tau,l})}}( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i})}}^{*}}} )} + {\phi_{{ran},{({\tau,l})}}k_{L,{ran},{({\tau,l})}}^{*}} + {\sum\limits_{i = 1}^{w_{t}}{\eta_{{ran},{({\tau,l})},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{ran},{({\tau,l})},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}} + {\sum\limits_{i = 1}^{w_{\tau}}{\eta_{{ran},{({\tau,l})},{({\tau,i})}}b_{\tau,{n_{\tau} + u_{\tau} + i}}^{*}}}}} & \lbrack {{Formula}\mspace{14mu} 150} \rbrack\end{matrix}$

(S507: Lower-Level Delegation Element Generation Step)

Using the processing device, the lower-level delegation elementgeneration unit 434 generates a lower-level delegation elementk*_(L+1,del,(τ,ι)) which is an element of the delegation key sk_(L+1),for each integer τ of τ=L+2, . . . , d and each integer ι of ι=1, . . ., n_(τ) with respect to each integer τ, as shown in Formula 151.

$\begin{matrix}{{k_{{L + 1},{del},{({\tau,l})}}^{*}:={{\sum\limits_{j = 1}^{2L}{\alpha_{{del},{({\tau,l})},j}k_{L,{ran},j}^{*}}} + {\sigma_{{del},{({\tau,l})}}( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i})}}^{*}}} )} + {\psi^{\prime}k_{L,{del},{({\tau,i})}}^{*}} + {\phi_{{del},{({\tau,l})}}k_{L,{ran},{({\tau,l})}}^{*}} + {\sum\limits_{i = 1}^{w_{t}}{\eta_{{del},{({\tau,i})},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{del},{({\tau,l})},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}} + {\sum\limits_{i = 1}^{w_{\tau}}{\eta_{{del},{({\tau,l})},{({\tau,i})}}b_{\tau,{n_{\tau} + u_{\tau} + i}}^{*}}}}},} & \lbrack {{Formula}\mspace{14mu} 151} \rbrack\end{matrix}$

(S508: Key Distribution Step)

Using the communication device and through the network, for example, thekey distribution unit 150 secretly provides to the lower-leveldecryption device 300 the delegation key sk_(L+1) (lower-leveldecryption key) having elements of the lower-level decryption elementk*_(L+1,dec), the first lower-level randomizing element k*_(L+1,ran,j′)(j′=1, . . . , 2(L+1)), the second lower-level randomizing elementk*_(L+1,ran,(τ,ι)) (τ=L+2, . . . , d; (τ,ι)=(τ,1), . . . , (τ,n_(τ))),and the lower-level delegation element k*_(L+1,del,(τ,ι)) (τ=L+2, . . ., d; (τ,ι)=(τ,1), . . . , (τ,n_(τ))). It is obvious that the delegationkey sk_(L+1) may be provided to the lower-level decryption device 300 byother methods.

To summarize, in (S501) to (S507), the key delegation device 400executes the Delegate_(L) algorithm shown in Formulas 152 and 153, andgenerates the delegation key sk_(L+1). Then, in (S508), the keydelegation device 400 provides the generated delegation key sk_(L+1) tothe lower-level decryption device 300.

$\begin{matrix}{{{Delegate}_{L}( {{pk},{sk}_{L},{{\overset{->}{v}}_{L + 1}:=( {v_{{L + 1},1},\ldots\mspace{14mu},v_{{L + 1},n_{L + 1}}} )}} )}:} & \lbrack {{Formula}\mspace{14mu} 152} \rbrack \\{{{for}\mspace{79mu}{{j = 1},\ldots\mspace{14mu},{{2L};}}\mspace{79mu}{{j^{\prime} = 1},\ldots\mspace{14mu},{{2( {L + 1} )};}}\mspace{79mu}{{\tau = {L + 2}},\ldots\mspace{14mu},{d;}}\mspace{79mu}{{( {\tau,l} ) = ( {\tau,l} )},\ldots\mspace{14mu},{( {\tau,n_{\tau}} );}}\mspace{79mu}{{t = 0},\ldots\mspace{14mu},{L + 1},{\tau;}}}} & \; \\{\mspace{76mu}{{{( {t,i} ) = ( {t,1} )},\ldots\mspace{14mu},{( {t,w_{t}} );}}\mspace{79mu}{\alpha_{{dec},j},\sigma_{dec},\alpha_{{ran},j^{\prime},j},\sigma_{{ran},j^{\prime}},\alpha_{{ran},{({\tau,l})},j},\sigma_{{ran},{({\tau,l})}},\mspace{79mu}\phi_{{ran},{({\tau,l})}},\alpha_{{del},{({\tau,l})},j},\sigma_{{del},{({\tau,l})}},\phi_{{del},{({\tau,l})}},\psi^{\prime},\mspace{79mu}\eta_{{dec},{({l,i})}},\eta_{{ran},j^{\prime},{({t,i})}},\eta_{{ran},{({\tau,l})},{({t,i})}},{\eta_{{del},{({\tau,l})},{({t,i})}}\overset{U}{\longleftarrow}{??}_{q}},}}} & \; \\{{k_{{L + 1},{dec}}^{*}:={k_{L,{dec}}^{*} + {\sum\limits_{j = 1}^{2L}{\alpha_{{dec},j}k_{L,{ran},j}^{*}}} + {\sigma_{dec}( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i})}}^{*}}} )} + {\sum\limits_{i = 1}^{w_{i}}{\eta_{{dec},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{dec},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}}}},} & \lbrack {{Formula}\mspace{14mu} 153} \rbrack \\{{k_{{L + 1},{ran},j^{\prime}}^{*}:={{\sum\limits_{j = 1}^{2L}{\alpha_{{ran},j^{\prime},j}k_{L,{ran},j}^{*}}} + {\sigma_{{ran},j^{\prime}}( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i})}}^{*}}} )} + {\sum\limits_{i = 1}^{w_{t}}{\eta_{{ran},j^{\prime},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{ran},j^{\prime},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}}}},} & \; \\{{k_{{L + 1},{ran},{({\tau,l})}}^{*}:={{\sum\limits_{j = 1}^{2L}{\alpha_{{ran},{({\tau,l})},j}k_{L,{ran},j}^{*}}} + {\sigma_{{ran},{({\tau,l})}}( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i})}}^{*}}} )} + {\phi_{{ran},{({\tau,l})}}k_{L,{ran},{({\tau,l})}}^{*}} + {\sum\limits_{i = 1}^{w_{t}}{\eta_{{ran},{({\tau,l})},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{ran},{({\tau,l})},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}} + {\sum\limits_{i = 1}^{w_{\tau}}{\eta_{{ran},{({\tau,l})},{({\tau,i})}}b_{\tau,{n_{\tau} + u_{\tau} + i}}^{*}}}}},} & \; \\{{k_{{L + 1},{del},{({\tau,l})}}^{*}:={{\sum\limits_{j = 1}^{2L}{\alpha_{{del},{({\tau,l})},j}k_{L,{ran},j}^{*}}} + {\sigma_{{del},{({\tau,l})}}( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i})}}^{*}}} )} + {\psi^{\prime}k_{L,{del},{({\tau,l})}}^{*}} + {\phi_{{del},{({\tau,l})}}k_{L,{ran},{({\tau,l})}}^{*}} + {\sum\limits_{i = 1}^{w_{i}}{\eta_{{del},{({\tau,l})},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{del},{({\tau,l})},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}} + {\sum\limits_{i = 1}^{w_{\tau}}{\eta_{{del},{({\tau,l})},{({\tau,i})}}b_{\tau,{n_{\tau} + u_{\tau} + i}}^{*}}}}},} & \; \\{{{sk}_{L + 1}:=( {k_{{L + 1},{dec}}^{*},\{ k_{{L + 1},{ran},j^{\prime}}^{*} \}_{{j^{\prime} = 1},\mspace{11mu}\ldots\mspace{14mu},{2{({L + 1})}}},\{ {k_{{L + 1},{ran},{({\tau,l})}}^{*},k_{{L + 1},{del},{({\tau,l})}}^{*}} \}_{{\tau = {L + 2}},\mspace{11mu}\ldots\mspace{14mu},{d;{{({\tau,t})} = {({\tau,1})}}},\mspace{11mu}\ldots\mspace{14mu},{({\tau,n_{\tau}})}}} )},\mspace{79mu}{{return}\mspace{14mu}{sk}_{L + 1}}} & \;\end{matrix}$

When the lower-level decryption device 300 executes the Dec algorithmusing the delegation key sk_(L+1), the session key K is computed in(S403) of FIG. 15 by computing Formula 145 if the inner product of(v{right arrow over ( )}₁, . . . , v{right arrow over ( )}_(L+1)) and(x{right arrow over ( )}₁, . . . , x{right arrow over ( )}_(L+1)) is 0.

As described above, the cryptographic processing system 10 according tothe first embodiment implements the HPE scheme for inner products of dlevels using the (d+1) number of N_(t) (t=0, . . . , d)-dimensionalspaces. Spaces required for the cryptographic processes at the L-thlevel (1≦L≦d) are the (L+1) number of N_(t) (t=0, . . . , L)-dimensionalspaces. Thus, key sizes can be made small, and efficiency of operationsand so on can be enhanced. Memory and register areas and so on forstoring keys are also made small.

In the above description, dimensions u_(t), w_(t), and z_(t) (t=0, . . ., d) are provided for enhanced security. Therefore, at the cost ofreduced security, dimensions u_(t), w_(t), and z_(t) (t=0, . . . , d)may be omitted by setting u_(t), w_(t), and z_(t) (t=0, . . . , d)respectively to 0.

In the above description, 1+u₀+1+w₀+z₀ is set in N₀, andn_(t)+u_(t)+w_(t)+z_(t) is set in N_(t). However, 1+u₀+1+w₀+z₀ may bereplaced with 1+1+1+1+1 so that 5 is set in N₀, andn_(t)+u_(t)+w_(t)+z_(t) may be replaced with n_(t)+n_(t)+n_(t)+1 so that3n_(t)+1 is set in N_(t).

In this case, the Setup algorithm shown in Formula 132 is rewritten asshown in Formula 154. G_(ob) is rewritten as shown in Formula 155.

$\begin{matrix}{{Setup}( {1^{\lambda},{\overset{->}{n}:={( {{d;n_{1}},\ldots\mspace{14mu},n_{d}} ):{{( {{param}_{\overset{->}{n}},\{ {{??}_{t},{??}_{t}^{*}} \}_{{t = 0},\mspace{11mu}\ldots\mspace{14mu},d}} )\overset{R}{\longleftarrow}{??}_{ob}}( {1^{\lambda},\overset{->}{n}} )}}},} } & \lbrack {{Formula}\mspace{14mu} 154} \rbrack \\{{{\hat{??}}_{0}:=( {b_{0,1},b_{0,3},b_{0,5}} )},{{\hat{??}}_{t}:={{( {b_{t,1},\ldots\mspace{14mu},b_{t,n_{t}},b_{t,{{3n_{t}} + 1}}} )\mspace{79mu}{for}\mspace{79mu} t} = 1}},\ldots\mspace{14mu},d,\mspace{79mu}{{\hat{??}}_{0}^{*}:=( {b_{0,1}^{*},b_{0,3}^{*}} )},{{\hat{??}}_{t}^{*}:={{( {b_{t,1}^{*},\ldots\mspace{14mu},b_{t,n_{t}}^{*}} )\mspace{79mu}{for}\mspace{79mu} t} = 1}},\ldots\mspace{14mu},d,} & \; \\{{{pk}:=( {1^{\lambda},{param}_{\overset{->}{n}},\{ {\hat{??}}_{t} \}_{{t = 0},\mspace{11mu}\ldots\mspace{14mu},d},b_{0,4}^{*},\{ {b_{t,{{2n_{t}} + 1}}^{*},\ldots\mspace{14mu},b_{t,{3n_{t}}}^{*}} \}_{{t = 1},\mspace{11mu}\ldots\mspace{14mu},d}} )},} & \; \\{\;{{{sk}:=\{ {\hat{??}}_{t}^{*} \}_{{t = 0},\mspace{11mu}\ldots\mspace{14mu},d}},\mspace{79mu}{{return}\mspace{14mu}{pk}},{{sk}.}}} & \; \\{\;{{{{{??}_{ob}( {1^{\lambda},{\overset{->}{n}:=( {{d;n_{1}},\ldots\mspace{14mu},n_{d}} )}} )}:\mspace{79mu} N_{0}}:=5},{N_{t}:={{3n_{t}} + {1\mspace{14mu}( {{t - 1},\ldots\mspace{14mu},d} )}}},\mspace{79mu}{{param}_{??}:={( {q,{??},{??}_{T},g,e} )\overset{R}{\longleftarrow}{{??}_{bpg}( 1^{\lambda} )}}},\mspace{79mu}{\psi\overset{U}{\longleftarrow}{??}_{q}^{x}},\mspace{79mu}{{{For}\mspace{14mu} t} = 0},\ldots\mspace{14mu},d,}} & \lbrack {{Formula}\mspace{14mu} 155} \rbrack \\{{{param}_{{??}_{t}}:={( {q,{??}_{t},{??}_{T},{??}_{t},e} ):={{??}_{dpvs}( {1^{\lambda},N_{t},{param}_{??}} )}}},} & \; \\{{X_{t}:={( \chi_{t,i,j} )_{i,j}\overset{U}{\longleftarrow}{{GL}( {N_{t},{??}_{q}} )}}},{( v_{t,i,j} )_{i,j}:={\psi \cdot ( X_{t}^{T} )^{- 1}}},} & \; \\{{b_{t,i}:={( {{\chi_{t,i,1,}\mspace{14mu}\ldots}\mspace{14mu},\chi_{t,i,N_{t}}} )_{{??}_{t}} = {\sum\limits_{j = 1}^{N_{t}}{\chi_{t,i,j}a_{t,j}}}}},{{??}_{t}:=( {b_{t,1},\ldots\mspace{14mu},b_{t,N_{t}}} )},} & \; \\{{b_{t,i}^{*}:={( {{v_{t,i,1,}\mspace{14mu}\ldots}\mspace{14mu},v_{t,i,N_{t}}} )_{{??}_{t}} = {\sum\limits_{j = 1}^{N_{t}}{v_{t,i,j}a_{t,j}}}}},{{??}_{t}^{*}:=( {b_{t,1}^{*},\ldots\mspace{14mu},b_{t,N_{t}}^{*}} )},} & \; \\{{g_{T}:={e( {g,g} )}^{\psi}},{{param}_{\overset{->}{n}}:=( {\{ {param}_{{??}_{t}} \}_{{t = 1},\mspace{11mu}\ldots\mspace{14mu},d,}g_{T}} )}} & \; \\{{return}\mspace{14mu}{( {{param}_{\overset{->}{n}},\{ {{??}_{t},{??}_{t}^{*}} \}_{{t = 0},\mspace{11mu}\ldots\mspace{14mu},d}} ).}} & \;\end{matrix}$

The KeyGen algorithm shown in Formulas 139 and 140 is rewritten as shownin Formulas 156 and 157.

$\begin{matrix}{{{KeyGen}( {{pk},{sk},{( {{\overset{->}{v}}_{1},\ldots\mspace{14mu},{\overset{->}{v}}_{L}} ):=( {v_{1,1},\ldots\mspace{14mu},v_{1,n_{1}}} )},\ldots\mspace{14mu},( {v_{L,1},\ldots\mspace{14mu},v_{L,n_{L}}} )} )}:} & \lbrack {{Formula}\mspace{14mu} 156} \rbrack \\{\mspace{85mu}{{for}\mspace{79mu}{{j = 1},\ldots\mspace{14mu},{{2L};}}\mspace{79mu}{{\tau = {L + 1}},\ldots\mspace{14mu},{d;}}\mspace{79mu}{{( {\tau,l} ) = ( {\tau,1} )},\ldots\mspace{14mu},{( {\tau,n_{\tau}} );}}\mspace{79mu}{\psi,s_{{dec},t},{{{s_{{ran},j,t}\overset{U}{\longleftarrow}{??}_{q}}\mspace{14mu}( {{t = 1},\ldots\mspace{14mu},L} )};}}}} & \; \\{\theta_{{dec},t},{\theta_{{ran},j,t}\overset{U}{\longleftarrow}{??}_{q}},{\overset{->}{\eta}}_{{dec},t},{{{{\overset{->}{\eta}}_{{ran},j,t}\overset{U}{\longleftarrow}{??}_{q}^{n_{t}}}\mspace{14mu}( {{t = 0},\ldots\mspace{14mu},L} )};}} & \; \\{s_{{ran},{({\tau,l})},t},{{s_{{del},{({\tau,l})},t}\overset{U}{\longleftarrow}{{??}_{q}( {{t = 1},\ldots\mspace{14mu},{L + 1}} )}};}} & \; \\{\theta_{{ran},{({\tau,l})},t},{\theta_{{del},{({\tau,l})},t}\overset{U}{\longleftarrow}{??}_{q}},{\overset{->}{\eta}}_{{ran},{({\tau,l})},t},{{\overset{->}{\eta}}_{{del},{({\tau,l})},t}\overset{U}{\longleftarrow}{??}_{q}^{n_{t}}},{( {{t = 0},\ldots\mspace{14mu},{L + 1}} );}} & \; \\{\;{{s_{{dec},0}:={\sum\limits_{t = 1}^{L}s_{{dec},t}}},{s_{{ran},j,0}:={\sum\limits_{t = 1}^{L}s_{{ran},j,t}}},\mspace{11mu}{s_{{ran},{({\tau,l})},0}:={\sum\limits_{t = 1}^{L + 1}s_{{ran},{({\tau,l})},t}}},{s_{{del},{({\tau,l})},0}:={\sum\limits_{t = 1}^{L + 1}s_{{del},{({\tau,l})},t}}},}} & \; \\{{k_{L,{dec}}^{*}:( {( {{- s_{{dec},0}},0,1,\eta_{{dec},0},0} )_{{??}_{0}^{*}},{( {{{s_{{dec},t}{\overset{->}{e}}_{t,1}} + {\theta_{{dec},t}{\overset{->}{v}}_{t}}},0^{n_{t}},{\overset{->}{\eta}}_{{dec},t},0} )_{{??}_{t}^{*}}:=1},\ldots\mspace{14mu},L} )},} & \lbrack {{Formula}\mspace{14mu} 157} \rbrack \\{{k_{L,{ran},j}^{*}:=( {( {{- s_{{ran},j,0}},0,0,\eta_{{ran},j,0},0} )_{{??}_{0}^{*}},{{( {{{s_{{ran},t}{\overset{->}{e}}_{t,1}} + {\theta_{{ran},j,t}{\overset{->}{v}}_{t}}},0^{n_{t}},{\overset{->}{\eta}}_{{ran},j,t},0} )_{{??}_{t}^{*}}:t} = 1},\ldots\mspace{14mu},L} )},} & \; \\{{k_{L,{ran},{({\tau,l})}}^{*}:=( {( {{{- s_{{ran},{({\tau,l})},0}}0},0,\eta_{{ran},{({\tau,l})},0},0} )_{{??}_{0}^{*}},{{( {{{s_{{ran},{({\tau,l})},t}{\overset{->}{e}}_{t,1}} + {\theta_{{ran},{({\tau,l})},t}{\overset{->}{v}}_{t}}},0^{n_{t}},{\overset{->}{\eta}}_{{ran},{({\tau,l})},t},0} )_{{??}_{t}^{*}}:t} = 1},\ldots\mspace{14mu},{L( {{s_{{ran},{({\tau,l})},{L + 1}}{\overset{->}{e}}_{\tau,1}},0^{n_{\tau}},{\overset{->}{\eta}}_{{ran},{({\tau,l})},{L + 1}},0} )}_{{??}_{\tau}^{*}}} )},} & \; \\{{k_{L,{del},{({\tau,l})}}^{*}:=( {( {{- s_{{del},{({\tau,l})},0}},0,0,\eta_{{del},{({\tau,l})},0},0} )_{{??}_{0}^{*}},{{( {{{s_{{del},{({\tau,l})},t}{\overset{->}{e}}_{t,1}} + {\theta_{{del},{({\tau,l})},t}{\overset{->}{v}}_{t}}},0^{n_{t}},{\overset{->}{\eta}}_{{del},{({\tau,l})},t},0} )_{{??}_{t}^{*}}:t} = 1},\ldots\mspace{14mu},{L( {{{s_{{del},{({\tau,l})},{L = 1}}{\overset{->}{e}}_{\tau,1}} + {\psi\;{\overset{->}{e}}_{\tau,l}}},0^{n_{\tau}},{\overset{->}{\eta}}_{{del},{({\tau,l})},{L + 1}},0} )}_{{??}_{\tau}^{*}}} )},} & \; \\{{{sk}_{L}:=( {k_{L,{dec}}^{*},\{ k_{L,{ran},j}^{*} \}_{{j = 1},\mspace{11mu}\ldots\mspace{14mu},{2L}},{\{ k_{L,{ran},{({\tau,l})}}^{*} \}_{{\tau = {L + 1}},\mspace{11mu}{{\ldots\mspace{14mu} d};{{({\tau,l})} = {({\tau,1})}}},\mspace{11mu}\ldots\mspace{14mu},{({\tau,n_{\tau}})},}\{ k_{L,{del},{({\tau,l})}}^{*} \}_{{\tau = {L + 1}},\mspace{11mu}\ldots\mspace{14mu},{d;{{({\tau,l})} = {({\tau,1})}}},\mspace{11mu}\ldots\mspace{14mu},{({\tau,n_{\tau}})}}}} )},} & \; \\{{{return}\mspace{14mu}{{sk}_{L}.}}\mspace{11mu}} & \;\end{matrix}$

The Enc algorithm shown in Formula 144 is rewritten as shown in Formula158.

$\begin{matrix}{{Enc}( {{pk},{m \in {??}_{T}},{{( {{\overset{->}{x}}_{1},\ldots\mspace{14mu},{\overset{->}{x}}_{L}} ):={( {( {x_{1,1},\ldots\mspace{14mu},x_{1,n_{1}}} ),\ldots\mspace{14mu},( {x_{L,1},\ldots\mspace{14mu},x_{L,n_{L}}} )} ):\mspace{79mu}{{( {{\overset{->}{x}}_{L + 1},\ldots\mspace{14mu},{\overset{->}{x}}_{d}} )\overset{U}{\longleftarrow}{??}_{q}^{n_{L + 1}}} \times \ldots \times {??}_{q}^{n_{d}}}}};\mspace{79mu}\omega},\zeta,\varphi_{0},\ldots\mspace{14mu},{\varphi_{d}\overset{U}{\longleftarrow}{??}_{q}},{c_{1}:=( {( {\omega,0,\zeta,0,\varphi_{0}} )_{{??}_{0}},{{( {{\omega\;{\overset{->}{x}}_{t}},0^{n_{t}},0^{n_{t}},\varphi_{t}} )_{{??}\; t}:t} = 1},\ldots\mspace{14mu},d} )},\mspace{79mu}{c_{2}:={g_{T}^{\zeta}m}},\mspace{79mu}{{ct}:=( {c_{1},c_{2}} )},\mspace{79mu}{{return}\mspace{14mu}{{ct}.}}} } & \lbrack {{Formula}\mspace{14mu} 158} \rbrack\end{matrix}$

The Delegate_(L) algorithm shown in Formulas 152 and 153 is rewritten asshown in Formulas 159 and 160.

$\begin{matrix}{{{Delegate}_{L}( {{pk},{sk}_{L},{{\overset{->}{v}}_{L + 1}:=( {v_{{L + 1},1},\ldots\mspace{14mu},v_{{L + 1},n_{L + 1}}} )}} )}:} & \lbrack {{Formula}\mspace{14mu} 159} \rbrack \\{\mspace{85mu}{{for}\mspace{79mu}{{j = 1},\ldots\mspace{14mu},{{2L};}}\mspace{79mu}{{j^{\prime} = 1},{{\ldots\mspace{14mu} 2( {L + 1} )};}}\mspace{79mu}{{\tau = {L + 2}},\ldots\mspace{14mu},{d;}}\mspace{79mu}{{( {\tau,l} ) = ( {\tau,1} )},\ldots\mspace{14mu},{( {\tau,n_{\tau}} );}}\mspace{79mu}{{t = 0},\ldots\mspace{14mu},{L + 1},{\tau;}}}} & \; \\{\mspace{70mu}{{{( {t,i} ) = ( {t,1} )},\ldots\mspace{14mu},{( {t,n_{t}} );}}\mspace{79mu}{\alpha_{{dec},j},\sigma_{dec},\alpha_{{ran},j^{\prime},j},{\sigma_{{ran},j^{\prime},}\alpha_{{ran},{({\tau,l})},j}},\sigma_{{ran},{({\tau,l})}},\mspace{79mu}\phi_{{ran},{({\tau,l})}},\alpha_{{del},{({\tau,l})},j},\sigma_{{del},{({\tau,l})}},\phi_{{del},{({\tau,l})}},\psi^{\prime},\mspace{79mu}\eta_{{dec},{({t,i})}},\eta_{{ran},j^{\prime},{({t,i})}},\eta_{{ran},{({\tau,l})},{({t,i})}},{\eta_{{del},{({\tau,l})},{({t,i})}}\overset{U}{\longleftarrow}{??}_{q}},}}} & \; \\{{k_{{L + 1},{dec}}^{*}:={k_{L,{dec}}^{*} + {\sum\limits_{j = 1}^{2L}{\alpha_{{dec},j}k_{L,{ran},j}^{*}}} + {\sigma_{dec}( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i})}}^{*}}} )} + {\eta_{{dec},{({0,1})}}b_{0,4}^{*}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{n_{t}}{\eta_{{dec},{({t,i})}}b_{t,{{2n_{t}} + i}}^{*}}}}}},} & \lbrack {{Formula}\mspace{14mu} 160} \rbrack \\{{k_{{L + 1},{ran},j^{\prime}}^{*}:={{\sum\limits_{j = 1}^{2L}{\alpha_{{ran},j^{\prime},j}k_{L,{ran},j}^{*}}} + {\sigma_{{ran},j^{\prime}}( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i})}}^{*}}} )} + {\eta_{{ran},j^{\prime},{({0,1})}}b_{0,4}^{*}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{n_{t}}{\eta_{{ran},j^{\prime},{({t,i})}}b_{t,{{2n_{t}} + i}}^{*}}}}}},} & \; \\{{k_{{L + 1},{ran},{({\tau,l})}}^{*}:={{\sum\limits_{j = 1}^{2L}{\alpha_{{ran},{({\tau,l})},j}k_{L,{ran},j}^{*}}} + {\sigma_{{ran},{({\tau,l})}}( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i})}}^{*}}} )} + {\phi_{{ran},{({\tau,l})}}k_{L,{ran},{({\tau,l})}}^{*}} + {\eta_{{ran},{({\tau,l})},{({0,1})}}b_{0,4}^{*}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{n_{t}}{\eta_{{ran},{({\tau,l})},{({t,i})}}b_{t,{{2n_{t}} + i}}^{*}}}} + {\sum\limits_{i = 1}^{n_{\tau}}{\eta_{{ran},{({\tau,l})},{({\tau,i})}}b_{\tau,{{2n_{\tau}} + i}}^{*}}}}},} & \; \\{{k_{{L + 1},{del},{({\tau,l})}}^{*}:={{\sum\limits_{j = 1}^{2L}{\alpha_{{del},{({\tau,l})},j}k_{L,{ran},j}^{*}}} + {\sigma_{{del},{({\tau,l})}}( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i})}}^{*}}} )} + {\psi^{\prime}k_{L,{del},{({\tau,i})}}^{*}} + {\phi_{{del},{({\tau,l})}}k_{L,{ran},{({\tau,l})}}^{*}} + {\eta_{{del},{({\tau,l})},{({0,1})}}b_{0,4}^{*}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{n_{t}}{\eta_{{del},{({\tau,l})},{({t,i})}}b_{t,{{2n_{t}} + i}}^{*}}}} + {\sum\limits_{i = 1}^{n_{\tau}}{\eta_{{del},{({\tau,l})},{({\tau,i})}}b_{\tau,{{2n_{\tau}} + i}}^{*}}}}},} & \; \\{{{sk}_{L + 1}:=( {k_{{L + 1},{dec}}^{*},\{ k_{{L + 1},{ran},j^{\prime}}^{*} \}_{{j^{\prime} = 1},\mspace{11mu}\ldots\mspace{14mu},{2{({L + 1})}}},\{ {k_{{L + 1},{ran},{({\tau,l})}}^{*},k_{{L + 1},{del},{({\tau,l})}}^{*}} \}_{{\tau = {L + 2}},\mspace{11mu}\ldots\mspace{14mu},{d;{{({\tau,l})} = {({\tau,1})}}},\mspace{11mu}\ldots\mspace{14mu},{({\tau,n_{\tau}})}}} )},} & \; \\{\mspace{79mu}{{return}\mspace{14mu}{sk}_{L + 1}}} & \;\end{matrix}$

The Dec algorithm shown in Formula 146 remains the same.

The Setup algorithm needs to be executed once when the cryptographicprocessing system 10 is set up, and does not have to be executed eachtime a decryption key is generated. In the above description, the Setupalgorithm and the KeyGen algorithm are executed by the key generationdevice 100. However, the Setup algorithm and the KeyGen algorithm may beexecuted by different devices.

Second Embodiment

In this embodiment, a generalized version of the HPE scheme for innerproducts discussed in the first embodiment will be described.

In the HPE scheme for inner products discussed in the first embodiment,a ciphertext ct can be decrypted by a decryption key, as a general rule,if the inner product of attribute information set in the ciphertext ctand predicate information set in the decryption key is 0.

However, in the HPE scheme for inner products to be discussed in thesecond embodiment, it may be arranged that decryption is possible evenif the inner product of the attribute information set in the ciphertextct and the predicate information set in the decryption key is not 0.

Specifically, in the following description, decryption is possible ifthe inner product of attribute information x{right arrow over ( )}_(t)and predicate information v{right arrow over ( )}_(t) is 0 for eachinteger t of ρ_(t) (t=1, . . . , d) having the value of 0 and if theinner product of the attribute information x{right arrow over ( )}_(t)and the predicate information v{right arrow over ( )}_(t) is not 0 foreach integer t of ρ_(t) (t=1, . . . , d) having the value of 1.

With this arrangement, it is possible to set a positive conditionalexpression (e.g., attribute information=predicate information) or anegative conditional expression (attribute information≠predicateinformation) depending on the setting of the value of ρ_(t) (t=1, . . ., d).

Referring to FIGS. 17 and 19, the HPE scheme for inner productsaccording to the second embodiment will be described, and functions andoperations of the cryptographic processing system 10 that implements theHPE scheme for inner products will be described.

A functional configuration of the cryptographic processing system 10according to the second embodiment is the same as a functionalconfiguration of the cryptographic processing system 10 according to thefirst embodiment shown in FIGS. 8 to 11.

FIG. 17 is a flowchart showing operations of the key generation device100 and showing a process of the KeyGen algorithm. FIG. 18 is aflowchart showing operations of the decryption device 300 and showing aprocess of the Dec algorithm. FIG. 19 is a flowchart showing operationsof the key delegation device 400 and showing a process of theDelegate_(L) algorithm.

Processes of the Setup algorithm and the Enc algorithm according to thesecond embodiment are the same as the processes of the Setup algorithmand the Enc algorithm according to the first embodiment, so thatdescription will be omitted. In the Enc algorithm, however, a ciphertextct to be transmitted to the decryption device 300 includes not onlyciphertexts c₁ and c₂ but also attribute information x{right arrow over( )}_(i) (i=1, . . . , L).

Referring to FIG. 17, the process of the KeyGen algorithm executed bythe key generation device 100 will be described.

(S601: Information Input Step)

Using the input device, the information input unit 130 inputs predicateinformation ((v{right arrow over ( )}₁,ρ₁), . . . , (v{right arrow over( )}_(L),ρ_(L))):=((v_(1,i) (i=1, . . . , n₁), ρ₁ε{0,1}), . . . ,(v_(L,i) (i=1, . . . , n_(L)), ρ_(L)ε{0,1})). As predicate information,an attribute of a user of a key is input.

(S602: Random Number Generation Step)

Using the processing device, the random number generation unit 141generates a random number ψ, random numbers s_(dec,t), s_(ran,j,t) (t=1,. . . , L), random numbers θ_(dec,t), θ_(ran,j,t), η{right arrow over ()}_(dec,t), η{right arrow over ( )}_(ran,j,t), η{right arrow over ()}_(ran,0,t), η{right arrow over ( )}_(del,0,t), η{right arrow over ()}_(del,1,t) (t=0, . . . , L), random numbers s_(ran,0,t), s_(del,0,t),s_(del,1,t) (t=0, . . . , L+1), random numbers θ_(ran,0,t), θ_(del,0,t),θ_(del,1,t) (t=0, . . . , L+1), and random numbers η{right arrow over ()}_(ran,(τ,ι)), η{right arrow over ( )}_(del,0,(τ,ι)), η{right arrowover ( )}_(del,1,(τ,ι)) for each of integers j, τ, ι of j=1, . . . , 2L,τ=L+1, . . . , d, (τ,ι)=(τ,1), . . . , (τ,n_(τ)), as shown in Formula161.

$\begin{matrix}{\mspace{79mu}{{{for}\mspace{79mu}{{j = 1},\ldots\mspace{14mu},{{2L};}}}\mspace{79mu}{{\tau = {l + 1}},\ldots\mspace{14mu},{d;}}\mspace{79mu}{{( {\tau,l} ) = ( {\tau,1} )},\ldots\mspace{14mu},{( {\tau,n_{\tau}} );}}\mspace{79mu}{\psi,s_{{dec},t},{{s_{{ran},j,t}\overset{U}{\longleftarrow}{??}_{q}}\mspace{14mu}( {{t = 1},\ldots\mspace{14mu},L} )},\mspace{79mu}\theta_{{dec},t},{{\theta_{{ran},j,t}\overset{U}{\longleftarrow}{??}_{q}}\mspace{14mu}( {{t = 0},\ldots\mspace{14mu},L} )},{{\overset{->}{\eta}}_{{dec},t}:={{( {\eta_{{dec},t,1},\ldots\mspace{14mu},\eta_{{dec},t,w_{t}}} )\overset{U}{\longleftarrow}{??}_{q}^{w_{t}}}\mspace{14mu}( {{t = 0},\ldots\mspace{14mu},L} )}},{{\overset{->}{\eta}}_{{ran},j,t}:={{( {\eta_{{ran},j,t,1},\ldots\mspace{14mu},\eta_{{ran},j,t,w_{t}}} )\overset{U}{\longleftarrow}{??}_{q}^{w_{t}}}\mspace{14mu}( {{t = 0},\ldots\mspace{14mu},L} )}},{{\overset{->}{\eta}}_{{ran},0,t}:={{( {\eta_{{ran},0,t,1},\ldots\mspace{14mu},\eta_{{ran},0,t,w_{t}}} )\overset{U}{\longleftarrow}{??}_{q}^{w_{t}}}\mspace{14mu}( {{t = 0},\ldots\mspace{14mu},L} )}},{{\overset{->}{\eta}}_{{del},0,t}:={{( {\eta_{{del},0,t,1},\ldots\mspace{14mu},\eta_{{del},0,t,w_{t}}} )\overset{U}{\longleftarrow}{??}_{q}^{w_{t}}}\mspace{14mu}( {{t = 0},\ldots\mspace{14mu},L} )}},{{\overset{->}{\eta}}_{{del},1,t}:={{( {\eta_{{del},1,t,1},\ldots\mspace{14mu},\eta_{{del},1,t,w_{t}}} )\overset{U}{\longleftarrow}{??}_{q}^{w_{t}}}\mspace{14mu}( {{t = 0},\ldots\mspace{14mu},L} )}},\mspace{79mu} s_{{ran},0,t},s_{{del},0,t},{{s_{{del},1,t}\overset{U}{\longleftarrow}{??}_{q}}\mspace{14mu}( {{t = 1},\ldots\mspace{14mu},{L + 1}} )},\mspace{79mu}\theta_{{ran},0,t},\theta_{{del},0,t},{{\theta_{{del},1,t}\overset{U}{\longleftarrow}{??}_{q}}\mspace{14mu}( {{t = 0},\ldots\mspace{14mu},{L + 1}} )},\mspace{79mu}{{\overset{->}{\eta}}_{{ran},0,{({\tau,l})}}:={( {\eta_{{ran},0,{({\tau,l})},1},\ldots\mspace{14mu},\eta_{{ran},0,{({\tau,l})},w_{l}}} )\overset{U}{\longleftarrow}{??}_{q}^{w_{t}}}},\mspace{79mu}{{\overset{->}{\eta}}_{{del},0,{({\tau,l})}}:={( {\eta_{{del},0,{({\tau,l})},1},\ldots\mspace{14mu},\eta_{{del},0,{({\tau,l})},w_{t}}} )\overset{U}{\longleftarrow}{??}_{q}^{w_{t}}}},\mspace{79mu}{{\overset{->}{\eta}}_{{del},1,{({\tau,l})}}:={( {\eta_{{del},1,{({\tau,l})},1},\ldots\mspace{14mu},\eta_{{del},1,{({\tau,l})},w_{l}}} )\overset{U}{\longleftarrow}{??}_{q}^{w_{t}}}}}}} & \lbrack {{Formula}\mspace{14mu} 161} \rbrack\end{matrix}$

s_(dec,0), s_(ran,j,0), s_(ran,0,0), s_(del,0,0), and s_(del,1,0) areset as shown in Formula 162.s _(dec,0):=Σ_(t=1) ^(L) s _(dec,t),s _(ran,j,0):=Σ_(t=1) ^(L) s _(ran,j,t),s _(ran,0,0):=Σ_(r=1) ^(L) s _(ran,0,t),s _(del,0,0):=Σ_(t=1) ^(L+1) s _(del,0,t),s _(del,1,0):=Σ_(t=1) ^(L+1) s _(del,1,t)  [Formula 162]

(S603: Decryption Element Generation Step)

Using the processing device, the decryption element generation unit 142generates a decryption element k*_(L,dec) which is an element of adecryption key sk_(L), as shown in Formula 163.

k L , dec * := ( ( - s dec , 0 , 0 u 0 , 1 , η → dec , 0 , 0 z 0 ) , { (s dec , t ⁢ e → t , 1 + θ dec , t , ⁢ v → t , 0 u t , η → dec , t , 0 z t) t * , if ⁢ ⁢ ρ t = 0 ( s dec , t ⁢ v → t , 0 u t , η → dec , t , 0 z t )t * , if ⁢ ⁢ ρ t = 1 } : t = 1 , … ⁢ , L ) [ Formula ⁢ ⁢ 163 ]

As described above, for the basis B and the basis B* shown in Formula110, Formula 111 is defined. Thus, Formula 163 denotes that coefficientsof basis vectors of the basis B*₀ and the basis B*_(t) (t=1, . . . , L)are set as described below to generate the decryption elementk*_(L,dec).

First, description will be directed to the basis B*₀. For simplicity ofnotation, a basis vector b*_(0,i) is identified using only the iportion. For example, a basis vector 1 denotes a basis vector b*_(0,1).Basis vectors 1, . . . , 3 denote basis vectors b*_(0,1), . . . ,b*_(0,3).

−s_(dec,0) is set as a coefficient of a basis vector 1 of the basis B*₀.0 is set as a coefficient of each of basis vectors 1+1, . . . , 1+u₀. 1is set as a coefficient of a basis vector 1+u₀+1. η_(dec,0,1), . . . ,η_(dec,0,w0) (where w0 denotes w₀) are respectively set as coefficientsof basis vectors 1+u₀+1+1, . . . , 1+u₀+1+w₀. 0 is set as a coefficientof each of basis vectors 1+u₀+1+w₀+1, . . . , 1+u₀+1+w₀+z₀.

Next, description will be directed to the basis B*_(t) (t=1, . . . , L).For simplicity of notation, a basis vector b*_(t,i) is identified usingonly the i portion. For example, a basis vector 1 denotes a basis vectorb*_(t,1). Basis vectors 1, . . . , 3 denote basis vectors b*_(t,1), . .. , b*_(t,3). Settings of the basis B*_(t) (t=1, . . . , L) varydepending on whether the value of ρ_(t) is 0 or 1.

When the value of ρ_(t) is 0, s_(dec,t)+θ_(dec,t)v_(t,1) is set as acoefficient of a basis vector 1 of the basis B*_(t) (t=1, . . . , L).θ_(dec,t)v_(t,2), . . . , θ_(dec,t)v_(t,nt) (where nt denotes n_(t)) arerespectively set as coefficients of basis vectors 2, . . . , n_(t). 0 isset as a coefficient of each of basis vectors n_(t)+1, . . . ,n_(t)+u_(t). η_(dec,t,1), . . . , η_(dec,t,wt) (where wt denotes w_(t))are respectively set as coefficients of basis vectors n_(t)+u_(t)+1, . .. , n_(t)+u_(t)+w_(t). 0 is set as a coefficient of each of basisvectors n_(t)+u_(t)+w_(t)+1, . . . , n_(t)+u_(t)+w_(t)+z_(t).

On the other hand, when the value of ρ_(t) is 1, s_(dec,t)v_(t,1), . . ., s_(dec,t)v_(t,nt) (where nt denotes n_(t)) are respectively set ascoefficients of basis vectors 1, . . . , n_(t) of the basis B*_(t) (t=1,. . . , L). 0 is set as a coefficient of each of basis vectors n_(t)+1,. . . , n_(t)+u_(t). η_(dec,t,1), . . . , η_(dec,t,wt) (where wt denotesw_(t)) are respectively set as coefficients of basis vectorsn_(t)+u_(t)+1, . . . , n_(t)+u_(t)+w_(t). 0 is set as a coefficient ofeach of basis vectors n_(t)+u_(t)+w_(t)+1, . . . ,n_(t)+u_(t)+w_(t)+z_(t).

(S604: First Randomizing Element Generation Step)

Using the processing device, the randomizing element generation unit 143generates a first randomizing element k*_(L,ran,j) which is an elementof the decryption key sk_(L), for each integer j of j=1, . . . , 2L, asshown in Formula 164.

k L , ran , j * := ( ( - s ran , j , 0 , 0 u 0 , 0 , η → ran , j , 0 , 0z 0 ) , { ( s ran , j , t ⁢ e → t , 1 + θ ran , j , t , ⁢ v → t , 0 u t ,η → ran , j , t , 0 z t ) t * , if ⁢ ⁢ ρ t = 0 ( s ran , j , t ⁢ v → t , 0u t , η → ran , j , t , 0 z t ) t * , if ⁢ ⁢ ρ t = 1 ⁢ } ⁢ : t = 1 , … ⁢ , L) [ Formula ⁢ ⁢ 164 ]

As described above, for the basis B and the basis B* shown in Formula110, Formula 111 is defined. Thus, Formula 164 denotes that coefficientsof basis vectors of the basis B*₀ and the basis B*_(t) (t=1, . . . , L)are set as described below to generate the first randomizing elementk*_(L,ran,j).

First, description will be directed to the basis B*₀. For simplicity ofnotation, a basis vector b*_(0,i) is identified using only the iportion. For example, a basis vector 1 denotes a basis vector b*_(0,1).Basis vectors 1, . . . , 3 denote basis vectors b*_(0,1), . . . ,b*_(0,3).

−s_(ran,j,0) is set as a coefficient of a basis vector 1 of the basisB*₀. 0 is set as a coefficient of each of basis vectors 1+1, . . . ,1+u₀+1. η_(ran,j,0,1), . . . , η_(ran,j,0,w0) (where w0 denotes w₀) arerespectively set as coefficients of basis vectors 1+u₀+1+1, . . . ,1+u₀+1+w₀. 0 is set as a coefficient of each of basis vectors1+u₀+1+w₀+1, . . . , 1+u₀+1+w₀+z₀.

Next, description will be directed to the basis B*_(t) (t=1, . . . , L).For simplicity of notation, a basis vector b*_(t,i) is identified usingonly the i portion. For example, a basis vector 1 denotes a basis vectorb*_(t,1). Basis vectors 1, . . . , 3 denote basis vectors b*_(t,1),b*_(t,3). Settings of the basis B*_(t) (t=1, . . . , L) vary dependingon whether the value of ρ_(t) is 0 or 1.

When the value of ρ_(t) is 0, s_(ran,j,t)+θ_(ran,j,t)v_(t,1) is set as acoefficient of a basis vector 1 of the basis B*_(t) (t=1, . . . , L).θ_(ran,j,t)v_(t,2), . . . , θ_(ran,j,t)v_(t,nt) (where nt denotes n_(t))are respectively set as coefficients of basis vectors 2, . . . , n_(t).0 is set as a coefficient of each of basis vectors n_(t)+1, . . . ,n_(t)+u_(t). η_(ran,j,t,1), . . . , η_(ran,j,t,wt) (where wt denotesw_(t)) are respectively set as coefficients of basis vectorsn_(t)+u_(t)+1, . . . , n_(t)+u_(t)+w_(t). 0 is set as a coefficient ofeach of basis vectors n_(t)+u_(t)+w_(t)+1, . . . ,n_(t)+u_(t)+w_(t)+z_(t).

On the other hand, when the value of ρ_(t) is 1, s_(ran,j,t)v_(t,1), . .. , s_(ran,j,t)v_(t,nt) (where nt denotes n_(t)) are respectively set ascoefficients of basis vectors 1, . . . , n_(t) of the basis B*_(t) (t=1,. . . , L). 0 is set as a coefficient of each of basis vectors n_(t)+1,. . . , n_(t)+u_(t). η_(ran,j,t,1), . . . , η_(ran,j,t,wt) (where wtdenotes w_(t)) are respectively set as coefficients of basis vectorsn_(t)+u_(t)+1, . . . , n_(t)+u_(t)+w_(t). 0 is set as a coefficient ofeach of basis vectors n_(t)+u_(t)+w_(t)+1, . . . ,n_(t)+u_(t)+w_(t)+z_(t).

(S605: Second Randomizing Element Generation Step)

Using the processing device, the randomizing element generation unit 143generates a second randomizing element k*_(L,ran,(τ,ι,0)) which is anelement of the decryption key sk_(L), for each integer τ of τ=L+1, . . ., d and each integer ι of ι=1, . . . , n_(τ) with respect to eachinteger τ, as shown in Formula 165.

k L , ran , ( τ , ι , 0 ) * := ( ( - s ran , 0 , 0 , 0 u 0 , 0 , η → ran, 0 , 0 , 0 z 0 ) 0 * , { ( s ran , 0 , t ⁢ e → t , 1 + θ ran , 0 , t , ⁢v → t , 0 u t , η → ran , 0 , t , 0 z t ) t * , if ⁢ ⁢ ρ t = 0 ( s ran , 0, t ⁢ v → t , 0 u t , η → ran , 0 , t , 0 z t ) t * , if ⁢ ⁢ ρ t = 1 ⁢ } ⁢ :t = 1 , … ⁢ , L ) , ⁢ ⁢ ( s ran , 0 , L + 1 ⁢ ⅇ → τ , 1 , 0 u τ , η → ran ,0 , ( τ , ι ) , 0 z τ ) τ * ) [ Formula ⁢ ⁢ 165 ]

As described above, for the basis B and the basis B* shown in Formula110, Formula 111 is defined. Thus, Formula 165 denotes that coefficientsof basis vectors of the basis B*₀, the basis B*_(t) (t=1, . . . , L) andthe basis B*_(τ) are set as described below to generate the secondrandomizing element k*_(L,ran,(τ,ι,0)).

First, description will be directed to the basis B*₀. For simplicity ofnotation, a basis vector b*_(0,i) is identified using only the iportion. For example, a basis vector 1 denotes a basis vector b*_(0,1).Basis vectors 1, . . . , 3 denote basis vectors b*_(0,1), . . . ,b*_(0,3).

−s_(ran,0,0) is set as a coefficient of a basis vector 1 of the basisB*₀. 0 is set as a coefficient of each of basis vectors 1+1, . . . ,1+u₀+1. η_(ran,0,0,1), . . . , η_(ran,0,0,w0) (where w0 denotes w₀) arerespectively set as coefficients of basis vectors 1+u₀+1+1, . . . ,1+u₀+1+w₀. 0 is set as a coefficient of each of basis vectors1+u₀+1+w₀+1, . . . , 1+u₀+1+w₀+z₀.

Next, description will be directed to the basis B*_(t) (t=1, . . . , L).For simplicity of notation, a basis vector b*_(t,i) is identified usingonly the i portion. For example, a basis vector 1 denotes a basis vectorb*_(t,1). Basis vectors 1, . . . , 3 denote basis vectors b*_(t,1), . .. , b*_(t,3). Settings of the basis B*_(t) (t=1, . . . , L) varydepending on whether the value of ρ_(t) is 0 or 1.

When the value of ρ_(t) is 0, s_(ran,0,t)+θ_(ran,0,t)v_(t,1) is set as acoefficient of a basis vector 1 of the basis B*_(t) (t=1, . . . , L).θ_(ran,0,t)v_(t,2), . . . , θ_(ran,0,t)v_(t,nt) (where nt denotes n_(t))are respectively set as coefficients of basis vectors 2, . . . , n_(t).0 is set as a coefficient of each of basis vectors n_(t)+1, . . . ,n_(t)+u_(t). η_(ran,0,t,1), . . . , η_(ran,0,t,wt) (where wt denotesw_(t)) are respectively set as coefficients of basis vectorsn_(t)+u_(t)+1, . . . , n_(t)+u_(t)+w_(t). 0 is set as a coefficient ofeach of basis vectors n_(t)+u_(t)+w_(t)+1, . . . ,n_(t)+u_(t)+w_(t)+z_(t).

On the other hand, when the value of ρ_(t) is 1, s_(ran,0,t)v_(t,1), . .. , s_(ran,0,t)v_(t,nt) (where nt denotes n_(t)) are respectively set ascoefficients of basis vectors 1, . . . , n_(t) of basis B*_(t) (t=1, . .. , L). 0 is set as a coefficient of each of basis vectors n_(t)+1, . .. , n_(t)+u_(t). η_(ran,0,t,1), . . . , η_(ran,0,t,wt) (where wt denotesw_(t)) are respectively set as coefficients of basis vectorsn_(t)+u_(t)+1, . . . , n_(t)+u_(t)+w_(t). 0 is set as a coefficient ofeach of basis vectors n_(t)+u_(t)+w_(t)+1, . . . ,n_(t)+u_(t)+w_(t)+z_(t).

Next, description will be directed to the basis B*_(τ). For simplicityof notation, a basis vector b*_(τ,i) is identified using only the iportion. For example, a basis vector 1 denotes a basis vector b*_(τ,1).Basis vectors 1, . . . , 3 denote basis vectors b*_(τt,1), . . . ,b*_(τ,3).

s_(ran,0,L+1) is set as a coefficient of a basis vector 1 of the basisB*_(τ). 0 is set as a coefficient of each of basis vectors 2, . . . ,n_(τ), . . . , n_(τ)+u_(τ). η_(ran,0,(τ,ι),1), . . . ,η_(ran,0,(τ,ι)s,wτ) (where wτ denotes w_(τ)) are respectively set ascoefficients of basis vectors n_(τ)+u_(τ)+1, . . . , n_(τ)+u_(τ)+w_(τ).0 is set as a coefficient of each of basis vectors n_(τ)+u_(τ)+w_(τ)+1,. . . , n_(τ)+u_(τ)+w_(τ)+z_(τ).

(S606: First Delegation Element Generation Step)

Using the processing device, the delegation element generation unit 144generates a first delegation element k*_(L,del,(τ,ι,0)) which is anelement of the decryption key sk_(L), for each integer τ of τ=L+1, . . ., d and each integer ι of ι=1, . . . , n_(τ) with respect to eachinteger τ, as shown in Formula 166.

k L , del , ( τ , ι , 0 ) * := ( ( - s del , 0 , 0 , 0 u 0 , 0 , η → del, 0 , 0 , 0 z 0 ) 0 * , { ( s del , 0 , t ⁢ e → t , 1 + θ del , 0 , t , ⁢v → t , 0 u t , η → del , 0 , t , 0 z t ) t * , if ⁢ ⁢ ρ t = 0 ( s del , 0, t ⁢ v → t , 0 u t , η → del , 0 , t , 0 z t ) t * , if ⁢ ⁢ ρ t = 1 ⁢ } ⁢ :t = 1 , … ⁢ , L ) , ⁢ ⁢ ( s del , 0 , L + 1 ⁢ e → τ , 1 , + ψ ⁢ ⁢ e → τ , ι ,0 u τ , η → del , 0 , ( τ , ι ) , 0 z τ ) τ * ) [ Formula ⁢ ⁢ 166 ]

As described above, for the basis B and the basis B* shown in Formula110, Formula 111 is defined. Thus, Formula 166 denotes that coefficientsof basis vectors of the basis B*₀, the basis B*_(t) (t=1, . . . , L),and the basis B*_(τ) are set as described below to generate the firstdelegation element k*_(L,del,(τ,ι,0)).

First, description will be directed to the basis B*₀. For simplicity ofnotation, a basis vector b*_(0,i) is identified using only the iportion. For example, a basis vector 1 denotes a basis vector b*_(0,1).Basis vectors 1, . . . , 3 denote basis vectors b*_(0,1), . . . ,b*_(0,3).

−s_(del,0,0) is set as a coefficient of a basis vector 1 of the basisB*₀. 0 is set as a coefficient of each of basis vectors 1+1, . . . ,1+u₀+1. η_(del,0,0,1), . . . , η_(del,0,0,w0) (where w0 denotes w₀) arerespectively set as coefficients of basis vectors 1+u₀+1+1, . . . ,1+u₀+1+w₀. 0 is set as a coefficient of each of basis vectors1+u₀+1+w₀+1, . . . , 1+u₀+1+w₀+z₀.

Next, description will be directed to the basis B*_(t) (t=1, . . . , L).For simplicity of notation, a basis vector b*_(t,i) is identified usingonly the i portion. For example, a basis vector 1 denotes a basis vectorb*_(t,1). Basis vectors 1, . . . , 3 denote basis vectors b*_(t,1), . .. , b*_(t,3). Settings of the basis B*_(t) (t=1, . . . , L) varydepending on whether the value of ρ_(t) is 0 or 1.

When the value of ρ_(t) is 0, s_(del,0,t)+θ_(del,0,t)v_(t,1) is set as acoefficient of a basis vector 1 of the basis B*_(t) (t=1, . . . , L).θ_(del,0,t)v_(t,2), . . . , θ_(del,0,t)v_(t,nt) (where nt denotes n_(t))are respectively set as coefficients of basis vectors 2, . . . , n_(t).0s is set as a coefficient of each of basis vectors n_(t)+1, . . . ,n_(t)+u_(t). η_(del,0,t,1), . . . , η_(del,0,t,wt) (where wt denotesw_(t)) are respectively set as coefficients of basis vectorsn_(t)+u_(t)+1, . . . , n_(t)+u_(t)+w_(t). 0 is set as a coefficient ofeach of basis vectors n_(t)+u_(t)+w_(t)+1, . . . ,n_(t)+u_(t)+w_(t)+z_(t).

On the other hand, when the value of ρ_(t) is 1, s_(del,0,t)v_(t,1), . .. , s_(del,0,t,)v_(t,nt) (where nt denotes n_(t)) are respectively setas coefficients of basis vectors 1, . . . , n_(t) of the basis B*_(t)(t=1, . . . , L). 0 is set as a coefficient of each of basis vectorsn_(t)+1, . . . , n_(t)+u_(t). η_(del,0,t,1), . . . , η_(del,0,t,wt)(where wt denotes w_(t)) are respectively set as coefficients of basisvectors n_(t)+u_(t)+1, . . . , n_(t)+u_(t)+w_(t). 0 is set as acoefficient of each of basis vectors n_(t)+u_(t)+w_(t)+1, . . . ,n_(t)+u_(t)+w_(t)+z_(t).

Next, description will be directed to the basis B*_(τ). For simplicityof notation, a basis vector b*_(τ,i) is identified using only the iportion. For example, a basis vector 1 denotes a basis vector b*_(τ,1).Basis vectors 1, . . . , 3 denote basis vectors b*_(τ,1), . . . ,b*_(τ,3).

s_(del,0,L+1)e{right arrow over ( )}_(τ,1)+ψe{right arrow over ()}_(τ,ι) is set as a coefficient of basis vectors 1, . . . , n_(τ) ofthe basis B*_(τ). 0 is set as a coefficient of each of basis vectorsn_(τ)+1, . . . , n_(τ)+u_(τ). η_(del,0,(τ,ι),1), . . . ,η_(del,0,(τ,ι),wτ) (where wτ denotes w_(τ)) are respectively set ascoefficients of basis vectors n_(τ)+u_(τ)+1, . . . , n_(τ)+u_(τ)+w_(τ).0 is set as a coefficient of each of basis vectors n_(τ)+u_(τ)+w_(τ)+1,. . . , n_(τ)+u_(τ)+w_(τ)+z_(τ).

(S607: Second Delegation Element Generation Step)

Using the processing device, the delegation element generation unit 144generates a second delegation element k*_(L,del,(τ,ι,1)) which is anelement of the decryption key sk_(L), for each integer τ of τ=L+1, . . ., d and each integer ι of ι=1, . . . , n_(τ) with respect to eachinteger τ, as shown in Formula 167.

k L , del , ( τ , ι , 1 ) * := ( ( - s del , 1 , 0 , 0 u 0 , 0 , η → del, 1 , 0 , 0 z 0 ) 0 * , { ( s del , 1 , t ⁢ e → t , 1 + θ del , 1 , t , ⁢v → t , 0 u t , η → del , 1 , t , 0 z t ) t * , if ⁢ ⁢ ρ t = 0 ( s del , 1, t ⁢ v → t , 0 u t , η → del , 1 , t , 0 z t ) t * , if ⁢ ⁢ ρ t = 1 ⁢ } ⁢ :t = 1 , … ⁢ , L ) , ⁢ ⁢ ( s del , 1 , L + 1 ⁢ e → τ , ι , 0 u τ , η → del ,1 , ( τ , ι ) , 0 z τ ) τ * ) [ Formula ⁢ ⁢ 167 ]

As described above, for the basis B and the basis B* shown in Formula110, Formula 111 is defined. Thus, Formula 167 denotes that coefficientsof basis vectors of the basis B*₀, the basis B*_(t) (t=1, . . . , L) andthe basis B*_(τ) are set as described below to generate the seconddelegation element k*_(L,del,(τ,ι,1)).

First, description will be directed to the basis B*₀. For simplicity ofnotation, a basis vector b*_(0,i) is identified using only the iportion. For example, a basis vector 1 denotes a basis vector b*_(0,1).Basis vectors 1, . . . , 3 denote basis vectors b*_(0,1), . . . ,b*_(0,3).

−s_(del,1,0) is set as a coefficient of a basis vector 1 of the basisB*₀. 0 is set as a coefficient of each of basis vectors 1+1, . . . ,1+u₀+1. η_(del,1,0,1), . . . , η_(del,1,0,w0) (where w0 denotes w₀) arerespectively set as coefficients of basis vectors 1+u₀+1+1, . . . ,1+u₀+1+w₀. 0 is set as a coefficient of each of basis vectors1+u₀+1+w₀+1, . . . , 1+u₀+1+w₀+z₀.

Next, description will be directed to the basis B*_(t) (t=1, . . . , L).For simplicity of notation, a basis vector b*_(t,i) is identified usingonly the i portion. For example, a basis vector 1 denotes a basis vectorb*_(t,1). Basis vectors 1, . . . , 3 denotes basis vectors b*_(t,1), . .. , b*_(t,3). Settings of the basis B*_(t) (t=1, . . . , L) varydepending on whether the value of ρ_(t) is 0 or 1.

When the value ρ_(t) is 0, s_(del,1,t)+θ_(del,1,t)v_(t,1) is set as acoefficient of a basis vector 1 of the basis B*_(t) (t=1, . . . , L).θ_(del,1,t)v_(t,2), . . . , θ_(del,1,t)v_(t,nt) (where nt denotes n_(t))are respectively set as coefficients of basis vectors 2, . . . , n_(t).0 is set as a coefficient of each of basis vectors n_(t)+1, . . . ,n_(t)+u_(t). η_(del,1,t,1), . . . , η_(del,1,t,wt) (where wt denotesw_(t)) are respectively set as coefficients of basis vectorsn_(t)+u_(t)+1, . . . , n_(t)+u_(t)+w_(t). 0 is set as a coefficient ofeach of basis vectors n_(t)+u_(t)+w_(t)+1, . . . ,n_(t)+u_(t)+w_(t)+z_(t).

On the other hand, when the value of ρ_(t) is 1, s_(del,1,t)v_(t,1), . .. , s_(del,1,t)v_(t,nt) (where nt denotes n_(t)) are respectively set ascoefficients of basis vectors 1, . . . , n_(t) of the basis B*_(t) (t=1,. . . , L). 0 is set as a coefficient of each of basis vectors n_(t)+1,. . . , n_(t)+u_(t). η_(del,1,t,1), . . . , η_(del,1,t,wt) (where wtdenotes w_(t)) are respectively set as coefficients of basis vectorsn_(t)+u_(t)+1, . . . , n_(t)+u_(t)+w_(t). 0 is set as a coefficient ofeach of basis vectors n_(t)+u_(t)+w_(t)+1, . . . ,n_(t)+u_(t)+w_(t)+z_(t).

Next, description will be directed to the basis B*_(τ). For simplicityof notation, a basis vector b*_(τ,i) is identified using only the iportion. For example, a basis vector 1 denotes a basis vector b*_(τ,1).Basis vectors 1, . . . , 3 denote basis vectors b*_(τ,1), . . . ,b*_(τ,3).

s_(del,1,L+1)e{right arrow over ( )}_(τ,ι) is set as a coefficient ofbasis vectors 1, . . . , n_(τ) of the basis B*_(τ). 0 is set as acoefficient of each of basis vectors n_(τ)+1, . . . , n_(τ)+u_(τ).η_(del,1,(τ,ι),1,), . . . , η_(del,1,(τ,ι),wτ) (where wτ denotes w_(τ))are respectively set as coefficients of basis vectors n_(τ)+u_(τ)+1, . .. , n_(τ)+u_(τ)+w_(τ). 0 is set as a coefficient of each of basisvectors n_(τ)+u_(τ)+w_(τ)+1, . . . , n_(τ)+u_(τ)+w_(τ)+z_(τ).

(S608: Key Distribution Step)

Using the communication device and through the network, for example, thekey distribution unit 150 secretly provides to the decryption device 300the decryption key sk_(L) having elements of the decryption elementk*_(L,dec), the first randomizing element k*_(L,ran,j) (j=1, . . . ,2L), the second randomizing element k*_(L,ran,(τ,ι,0)) (τ=L+1, . . . ,d; (τ,ι)=(τ,1), . . . , (τ,n_(τ))), the first delegation elementk*_(L,del,(τ,ι,0)) (τ=L+1, . . . , d; (τ,ι)=(τ,1), . . . , (τ,n_(τ))),and the second delegation element k*_(L,del,(τ,ι,1)) (τ=L+1, . . . , d;(τ,ι)=(τ,1), . . . , (τ,n_(τ))). It is obvious that the decryption keysk_(L) may be provided to the decryption device 300 by other methods.

To summarize, in (S601) to (S607), the key generation device 100executes the KeyGen algorithm shown in Formulas 168 and 169, andgenerates the decryption key sk_(L). Then, in (S608), the key generationdevice 100 provides the generated decryption key sk_(L) to thedecryption device 300.

KeyGen ⁡ ( p ⁢ ⁢ k , sk , ( v → 1 , ρ 1 ) , … ⁢ , ( v → L , ρ L ) ) := ( ( (v 1 ⁢ , 1 , … ⁢ , v 1 ⁢ , n 1 ) ∈ q n 1 , ρ 1 ∈ { 0 , 1 } ) , … ⁢ , ( ( v L ⁢, 1 , … ⁢ , v L ⁢ , n L ) ∈ q n L , ρ L ∈ { 0 , 1 } ) ) : [ Formula ⁢ ⁢ 168] for ⁢ ⁢ j = 1 , … ⁢ , 2 ⁢ L ; τ = L + 1 ⁢ … ⁢ , d ; ( τ , ι ) = ( τ , 1 ) ,… ⁢ , ( τ , n τ ) ; ψ , s dec , t , s ran , j , t ⁢ ⟵ U ⁢ q ⁢ ( t = 1 , … ⁢ ,L ) ; ⁢ ⁢ ⁢ θ dec , t , θ ran . j , t ⁢ ⟵ U ⁢ q , ⁢ ⁢ η → dec , t , η → ran , j, t , η → ran , 0 , t , η → del , 0 , t ⁢ η → del , 1 , t ⁢ ⟵ U ⁢ q w t ⁢ (t = 0 , … ⁢ , L ) ; ⁢ ⁢ ⁢ s ran , 0 , t , s del , 0 , t , s del , 1 , t ⁢ ⟵ U⁢q , ⁢ ⁢ θ ran , 0 , t , θ del , 0 , t , θ del , 1 , t ⁢ ⟵ U ⁢ q , η → ran ,0 , ( τ , ι ) , η → del , 0 , ( τ , ι ) , η → del , 1 , ( τ , ι ) ⁢ ⟵ U ⁢q w t , ⁢ ⁢ ( t = 0 , … ⁢ , L + 1 ) ; s dec , 0 := ∑ t = 1 L ⁢ s dec , t , sran , j , 0 := ∑ t = 1 L ⁢ s ran , j , t , ⁢ ⁢ s ran , 0 , 0 := ∑ t = 1 L ⁢s ran , 0 , t , s del , 0 , 0 := ∑ t = 1 L + 1 ⁢ s del , 0 , t , s del ,1 , 0 := ∑ t = 1 L + 1 ⁢ ⁢ s del , 1 , t , k L , dec * := ( ( - s dec , 0, 0 u 0 , 1 , η → dec , 0 , 0 z 0 ) , { ( s dec , t ⁢ e → t , 1 + θ dec ,t , ⁢ v → t , 0 u t , η → dec , t , 0 z t ) t * , if ⁢ ⁢ ρ t = 0 ( s dec ,t ⁢ v → t , 0 u t , η → dec , t , 0 z t ) t * if ⁢ ⁢ ρ t = 1 } : t = 1 , … ⁢, L ) k L , ran , j * := ( ( - s ran , j , 0 , 0 u 0 , 0 , η → ran , j ,0 , 0 z 0 ) , { ( s ran , j , t ⁢ e → t , 1 + θ ran , j , t , ⁢ v → t , 0u t , η → ran , j , t , 0 z t ) t * , if ⁢ ⁢ ρ t = 0 ( s ran , j , t ⁢ v →t , 0 u t , η → ran , j , t , 0 z t ) t * if ⁢ ⁢ ρ t = 1 ⁢ } ⁢ : t = 1 , … ⁢, L ) k L , ran , ( τ , ι , 0 ) * := ( ( - s ran , 0 , 0 , 0 u 0 , 0 , η→ ran , 0 , 0 , 0 z 0 ) 0 * , { ( s ran , 0 , t ⁢ e → t , 1 + θ ran , 0 ,t , ⁢ v → t , 0 u t , η → ran , 0 , t , 0 z t ) t * , if ⁢ ⁢ ρ t = 0 ( sran , 0 , t ⁢ v → t , 0 u t , η → ran , 0 , t , 0 z t ) t * , if ⁢ ⁢ ρ t =1 ⁢ } ⁢ : t = 1 , … ⁢ , L ) , [ Formula ⁢ ⁢ 169 ] ( s ran , 0 , L + 1 ⁢ ⅇ → τ, 1 , 0 u τ , η → ran , 0 , ( τ , ι ) , 0 z τ ) τ * ) , k L , del , ( τ, ι , 1 ) * := ( ( - s del , 1 , 0 , 0 u 0 , 0 , η → del , 1 , 0 , 0 z 0) 0 * , { ( s del , 1 , t ⁢ e → t , 1 + θ del , 1 , t , ⁢ v → t , 0 u t ,η → del , 1 , t , 0 z t ) t * , if ⁢ ⁢ ρ t = 0 ( s del , 1 , t ⁢ v → t , 0u t , η → del , 1 , t , 0 z t ) t * , if ⁢ ⁢ ρ t = 1 ⁢ } ⁢ : t = 1 , … ⁢ , L) , ( s del , 1 , L + 1 ⁢ e → τ , ι , 0 u τ , η → del , 1 , ( τ , ι ) , 0z τ ) τ * ) , ⁢ ⁢ sk L + 1 := ( ( ( v → 1 , ρ 1 ) , … ⁢ , ( v → L , ρ L ) ); ⁢ ⁢ k L , dec * , { k L , ran , j * } j = 1 , … ⁢ , 2 ⁢ ( L ) , { k L ,ran , ( τ , ι , 0 ) * , k L , del , ( τ , ι , 0 ) * ,   k L , del , ( τ, ι , 1 ) * } τ = L + 1 , … ⁢ , d ; ( τ , ι ) = ( τ , 1 ) , … ⁢ , ( τ , nτ ) ) , return ⁢ ⁢ sk L .

Referring to FIG. 18, the process of the Dec algorithm executed by thedecryption device 300 will be described.

(S701: Decryption Key Acquisition Step)

Using the communication device and through the network, for example, thedecryption key acquisition unit 310 obtains the decryption key sk_(L).The decryption key acquisition unit 310 also obtains the master publickey pk generated by the key generation device 100.

(S702: Data Receiving Step)

Using the communication device and through the network, for example, thedata receiving unit 320 receives the ciphertext ct transmitted by theencryption device 200.

(S703: Pairing Operation Step)

Using the processing device, the pairing operation unit 330 performs apairing operation shown in Formula 170, and computes a session keyK=g_(T) ^(ζ).

$\begin{matrix}{K:={{e( {c_{1,0},k_{L,{dec},0}^{*}} )} \cdot {\prod\limits_{{1 \leq t \leq {d\bigwedge\rho_{t}}} = 0}\;{{e( {c_{1,t},k_{L,{dec},t}^{*}} )} \cdot {\prod\limits_{{1 \leq t \leq {d\bigwedge\rho_{t}}} = 1}\;{e( {c_{1,t},k_{L,{dec},t}^{*}} )}^{1/{({{\overset{arrow}{v}}_{t} \cdot {\overset{arrow}{x}}_{t}})}}}}}}} & \lbrack {{Formula}\mspace{14mu} 170} \rbrack\end{matrix}$

Here, Formula 171 is defined.(k* _(L,dec,0)ε

, . . . , k*_(L,dec,d)ε

):=k* _(L,dec), (c _(1,0)ε

, . . . , c_(1,d)ε

:=c₁  [Formula 171]

The session key K is computed by computing Formula 170 if the innerproduct of v{right arrow over ( )}_(t) and x{right arrow over ( )}_(t)is 0 for each integer t of ρ_(t)=0 and if the inner product of v{rightarrow over ( )}_(t) and x{right arrow over ( )}_(t) is not 0 for eachinteger t of ρ_(t)=1 with respect to each integer t of t=1, . . . , L.

(S704: Message Computation Step)

Using the processing device, the message computation unit 340 dividesthe ciphertext c2 by the session key K, and thereby computes a messagem′ (=m).

To summarize, in (S701) to (S704), the decryption device 300 executesthe Dec algorithm shown in Formula 172, and computes the message m′(=m).

⁢Dec ⁡ ( p ⁢ ⁢ k , sk L , ct ) ⁢ : ⁢ ⁢ K := e ⁡ ( c 1 , 0 ⁢ k L , dec , 0 * ) · ∏1 ≤ t ≤ d ⋀ ρ t = 0 ⁢ ⁢ e ⁡ ( c 1 , t , k L , dec , t * ) · ∏ 1 ≤ t ≤ d ⋀ ρt = 1 ⁢ ⁢ e ⁡ ( c 1 , t , k L , dec , t * ) 1 / ( v → t · x → t ) , ⁢ ⁢ where⁢⁢( k L , dec , 0 * ∈ 〈 0 * 〉 , … ⁢ , k L , dec , d * ∈ 〈 d * 〉 ) := kL , dec * , ⁢ ⁢ ( c 1 , 0 ∈ 〈 0 * 〉 , … ⁢ , c 1 , d ∈ 〈 d * 〉 ) := c 1, ⁢ ⁢ m ′ := c 2 / K , ⁢ ⁢ return ⁢ ⁢ m ′ . [ Formula ⁢ ⁢ 172 ]

Referring to FIG. 19, the process of the Delegate_(L) algorithm executedby the key delegation device 400 will be described.

(S801: Decryption Key Acquisition Step)

Using the communication device and through the network, for example, thedecryption key acquisition unit 410 obtains the decryption key sk_(L).The decryption key acquisition unit 410 also obtains the master publickey pk generated by the key generation device 100.

(S802: Information Input Step)

Using the input device, the information input unit 420 inputs predicateinformation (v{right arrow over ( )}_(L+1), ρ_(L+1)):=(v_(L+1,i) (i=1, .. . , n_(L+1)), ρ_(L+1)ε{0,1}). As predicate information, an attributeof a person to whom the key is delegated is input.

(S803: Random Number Generation Step)

Using the processing device, the random number generation unit 431generates random numbers α_(dec,j), σ_(dec), α_(ran,j′,j), σ_(ran,j′),α_(ran,(τ,ι,0),j), σ_(ran,(τ,ι,0)), φ_(ran,(τ,ι,0)), α_(del,(τ,ι,0),j),σ_(del,(τ,ι,0)), φ_(del,(τ,ι,0)), α_(del,(τ,ι,1),j), σ_(del,(τ,ι,1)),φ_(del,(τ,ι,1)), η_(dec,(t,i)), η_(ran,j′,(t,i)), η_(ran,(τ,ι,0),(t,i)),η_(del,(τ,ι,0),(t,i)), η_(del,(τ,ι,1),(t,i)), ψ₀, ψ₁, for each integerj, j′, τ, ι, t, i of j=1, . . . , 2L, j′=1, . . . , 2(L+1), τ=L+2, . . ., d, (τ,ι)=(τ,1), . . . , (τ,n_(τ)), t=0, . . . , L+1, τ, (t,i)=(t,1), .. . , (t,n_(t)), as shown in Formula 173.

for ⁢ ⁢ j = 1 , … ⁢ , 2 ⁢ L ; j ′ = 1 , … ⁢ , 2 ⁢ ( L + 1 ) ; ⁢ ⁢ τ = L + 2 , … ⁢, d ; ( τ , ι ) = ( τ , 1 ) , … ⁢ , ( τ , n τ ) ; ⁢ ⁢ t = 0 , … ⁢ , L + 1 ,τ ; ( t , i ) = ( t = 1 ) , … ⁢ , ( t , w t ) ; ⁢ ⁢ α dec , j , σ dec , αran , j ′ , j , σ ran , j ′ , α ran , ( τ , ι , 0 ) , j , ⁢ σ ran , ( τ ,ι , 0 ) , ϕ ran , ( τ , ι , 0 ) , α del , ( τ , ι , 0 ) , j , σ del , (τ , ι , 0 ) , ⁢ ϕ del , ( τ , ι , 0 ) , α del , ( τ , ι , l ) , j , σ del, ( τ , ι , 1 ) , ϕ del , ( τ , ι , l ) , ⁢ η dec , ( t , i ) , η ran , j′ , ( t , i ) , η ran , ( τ , ι , 0 ) , ( t , i ) , η del , ( τ , ι , 0) , ( t , i ) , ⁢ η del , ( τ , ι , 1 ) , ( t , i ) , ψ 0 , ψ 1 , ⟵ U ⁢ q[ Formula ⁢ ⁢ 173 ]

(S804: Lower-Level Decryption Element Generation Step)

Using the processing device, the lower-level decryption elementgeneration unit 432 generates a lower-level decryption elementk*_(L+1,dec) which is an element of a delegation key sk_(L+1), as shownin Formula 174.

$\begin{matrix}{k_{{L + 1},{dec}}^{*}:={k_{L,{dec}}^{*} + {\sum\limits_{j = 1}^{2L}{\alpha_{{dec},j}k_{L,{ran},j}^{*}}} + \begin{Bmatrix}( {\sigma_{dec}( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i,0})}}^{*}}} )}  & {{{if}\mspace{14mu}\rho_{t}} = 0} \\( {\sigma_{dec}( {\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \rbrack^{L} +} }  & {{{if}\mspace{14mu}\rho_{t}} = 1} \\ {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \rbrack}_{L}} ) & \;\end{Bmatrix} + {\sum\limits_{i = 1}^{w_{t}}{\eta_{{dec},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{dec},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}}}} & \lbrack {{Formula}\mspace{14mu} 174} \rbrack\end{matrix}$

(S805: First Lower-Level Randomizing Element Generation Step)

Using the processing device, the lower-level randomizing elementgeneration unit 433 generates a first lower-level randomizing elementk*_(L+1,ran,j′) which is an element of the delegation key sk_(L+1), foreach integer j′ of j′=1, . . . , 2(L+1), as shown in Formula 175.

$\begin{matrix}{k_{{L + 1},{ran},j^{\prime}}^{*}:={{\sum\limits_{j = 1}^{2L}{\alpha_{{ran},j^{\prime},j}k_{L,{ran},j}^{*}}} + \begin{Bmatrix}{\sigma_{{ran},j^{\prime}}( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i,0})}}^{*}}} )} & {{{if}\mspace{14mu}\rho_{t}} = 0} \\{\sigma_{{ran},j^{\prime}}( {\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \rbrack^{L} +} } & {{{if}\mspace{14mu}\rho_{t}} = 1} \\ {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \rbrack}_{L}} ) & \;\end{Bmatrix} + {\sum\limits_{i = 1}^{w_{t}}{\eta_{{ran},j^{\prime},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{ran},j^{\prime},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}}}} & \lbrack {{Formula}\mspace{14mu} 175} \rbrack\end{matrix}$

(S806: Second Lower-Level Randomizing Element Generation Step)

Using the processing device, the lower-level randomizing elementgeneration unit 433 generates a second lower-level randomizing elementk*_(L+1,ran,(τ,ι)) which is an element of the delegation key sk_(L+1),for each integer τ of τ=L+2, . . . , d and each integer ι of ι=1, . . ., n_(τ) with respect to each integer τ, as shown in Formula 176.

$\begin{matrix}{k_{{L + 1},{ran},{({\tau,\iota,0})}}^{*}:={{\sum\limits_{j = 1}^{2L}{\alpha_{{ran},{{({\tau,\iota})}j},}k_{L,{ran},j}^{*}}} + {\phi_{{ran},{({\tau,\iota,0})}}k_{L,{ran},{({\tau,\iota,0})}}^{*}} + \begin{Bmatrix}{\sigma_{{ran},{({\tau,\iota,0})}}( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i,0})}}^{*}}} )} & {{{if}\mspace{14mu}\rho_{t}} = 0} \\{\sigma_{{ran},{({\tau,\iota,0})}}( {\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \rbrack^{L} +} } & {{{if}\mspace{14mu}\rho_{t}} = 1} \\ {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \rbrack}_{L}} ) & \;\end{Bmatrix} + {\sum\limits_{i = 1}^{w_{t}}{\eta_{{del},{({\tau,\iota,0})},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{del},{({\tau,\iota,0})},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}} + {\sum\limits_{i = 1}^{w_{\tau}}{\eta_{{del},{({\tau,\iota,0})},{({\tau,i})}}b_{\tau,{n_{\tau} + u_{\tau} + i}}^{*}}}}} & \lbrack {{Formula}\mspace{14mu} 176} \rbrack\end{matrix}$

(S807: First Lower-Level Delegation Element Generation Step)

Using the processing device, the lower-level delegation elementgeneration unit 434 generates a first lower-level delegation elementk*_(L+1,del,(τ,ι,0)) which is an element of the delegation key sk_(L+1),for each integer τ of τ=L+2, . . . , d and each integer ι of ι=1, . . ., n_(τ) with respect to each integer τ, as shown in Formula 177.

$\begin{matrix}{k_{{L + 1},{del},{({\tau,\iota,0})}}^{*}:={{\sum\limits_{j = 1}^{2L}{\alpha_{{del},{({\tau,\iota,0})},j}k_{L,{ran},j}^{*}}} + {\phi_{{del},{({\tau,\iota,0})}}k_{L,{{ran}{({\tau,\iota,0})}}}^{*}} + {\psi_{0}k_{L,{{del}{({\tau,\iota,0})}}}^{*}} + \begin{Bmatrix}{\sigma_{{del},{({\tau,\iota,0})}}( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i,0})}}^{*}}} )} & {{{if}\mspace{14mu}\rho_{t}} = 0} \\{\sigma_{{del},{({\tau,\iota,0})}}( {\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \rbrack^{L} +} } & {{{if}\mspace{14mu}\rho_{t}} = 1} \\ {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \rbrack}_{L}} ) & \;\end{Bmatrix} + {\sum\limits_{i = 1}^{w_{t}}{\eta_{{del},{({\tau,\iota,0})},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{del},{({\tau,\iota,0})},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}} + {\sum\limits_{i = 1}^{w_{\tau}}{\eta_{{del},{({\tau,\iota,0})},{({\tau,i})}}b_{\tau,{n_{\tau} + u_{\tau} + i}}^{*}}}}} & \lbrack {{Formula}\mspace{14mu} 177} \rbrack\end{matrix}$

(S808: Second Lower-Level Delegation Element Generation Step)

Using the processing device, the lower-level delegation elementgeneration unit 434 generates a second lower-level delegation elementk*_(L+1,del,(τ,ι,1)) which is an element of the delegation key sk_(L+1),for each integer τ of τ=L+2, . . . , d and each integer ι of ι=1, . . ., n_(τ) with respect to each integer τ, as shown in Formula 178.

$\begin{matrix}{k_{{L + 1},{del},{({\tau,\iota,1})}}^{*}:={{\sum\limits_{j = 1}^{2L}{\alpha_{{{del}{({\tau,\iota,1})}},j}k_{L,{ran},j}^{*}}} + {\psi_{1}k_{L,{{del}{({\tau,\iota,1})}}}^{*}} + \begin{Bmatrix}{\sigma_{{del},{({\tau,\iota,1})}}( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i,0})}}^{*}}} )} & {{{if}\mspace{14mu}\rho_{t}} = 0} \\{\sigma_{{del},{({\tau,\iota,1})}}( {\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \rbrack^{L} +} } & {{{if}\mspace{14mu}\rho_{t}} = 1} \\ {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \rbrack}_{L}} ) & \;\end{Bmatrix} + {\sum\limits_{i = 1}^{w_{t}}{\eta_{{del},{({\tau,\iota,1})},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{del},{({\tau,\iota,1})},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}} + {\sum\limits_{i = 1}^{w_{\tau}}{\eta_{{del},{({\tau,\iota,1})},{({\tau,i})}}b_{\tau,{n_{\tau} + u_{\tau} + i}}^{*}}}}} & \lbrack {{Formula}\mspace{14mu} 178} \rbrack\end{matrix}$

(S809: Key Distribution Step)

Using the communication device and through the network, for example, thekey distribution unit 150 secretly provides to the lower-leveldecryption device 300 the delegation key sk_(L+1) having elements of thelower-level decryption element k*_(L+1,dec), the first lower-levelrandomizing element k*_(L+1,ran,j′) (j′=1, . . . , 2(L+1)), the secondlower-level randomizing element k*_(L+1,ran,(τ,ι,0)) (τ=L+2, . . . , d;(τ,ι)=(τ,1), . . . , (τ,n_(τ))), the first lower-level delegationelement k*_(L+2,del,(τ,ι,0)) (τ=L+2, . . . , d; (τ,ι)=(τ,1), . . . ,(τ,n_(τ))), and the second lower-level delegation elementk*_(L+2,del,(τ,ι,1)) (τ=L+2, . . . , d; (τ,ι)=(τ,1), . . . , (τ,n_(τ))).It is obvious that the delegation key sk_(L+1) may be provided to thelower-level decryption device 300 by other methods.

To summarize, in (S501) to (S507), the key delegation device 400executes the Delegate_(L) algorithm shown in Formulas 179 and 180, andgenerates the delegation key sk_(L+1). Then, in (S508), the keydelegation device 400 provides the generated delegation key sk_(L+1) tothe lower-level decryption device 300.

Delegate L ⁡ ( p ⁢ ⁢ k , sk L , ( v → L + 1 , ρ L + 1 ) := ( ( v L + 1 , 1, … ⁢ , v L + 1 , n L + 1 ) , ρ L + 1 ) ) : [ Formula ⁢ ⁢ 179 ] for ⁢ ⁢ j = 1, … ⁢ , 2 ⁢ L ; j ′ = 1 , … ⁢ , 2 ⁢ ( L + 1 ) ; ⁢ ⁢ ⁢ τ = L + 2 , … ⁢ , d ; ( τ, ι ) = ( τ , 1 ) , … ⁢ , ( τ , n τ ) ; ⁢ ⁢ ⁢ t = 0 , … ⁢ , L + 1 , τ ; ( t ,i ) = ( t = 1 ) , … ⁢ , ( t , w t ) ; ⁢ ⁢ ⁢ α dec , j , σ dec , α ran , j ′, j , σ ran , j ′ , α ran , ( τ , ι , 0 ) , j , ⁢ σ ran , ( τ , ι , 0 ) ,ϕ ran , ( τ , ι , 0 ) , α del , ( τ , ι , 0 ) , j , σ del , ( τ , ι , 0) , ⁢ ⁢ ϕ del , ( τ , ι , 0 ) , α del , ( τ , ι , l ) , j , σ del , ( τ ,ι , 1 ) , ϕ del , ( τ , ι , l ) , ⁢ ⁢ η dec , ( t , i ) , η ran , j ′ , (t , i ) , η ran , ( τ , ι , 0 ) , ( t , i ) , η del , ( τ , ι , 0 ) , (t , i ) , ⁢ ⁢ η del , ( τ , ι , 1 ) , ( t , i ) , ψ 0 , ψ 1 , ⟵ U ⁢ q , kL + 1 , dec * := k L , dec * + ∑ j = 1 2 ⁢ L ⁢ α dec , j ⁢ k L , ran ,j * + { ( σ dec ⁡ ( ∑ i = 1 n L + 1 ⁢ v L + 1 , i ⁢ k L , del , ( L + 1 , i, 0 ) * ) if ⁢ ⁢ ρ t = 0 ( σ dec ( [ k L , del , ( L + 1 , i , 1 ) * ] L +if ⁢ ⁢ ρ t = 1 ∑ i = 1 n L + 1 ⁢ v L + 1 , i ⁡ [ k L , del , ( L + 1 , i , 1) * ] L ) } + ∑ i = 1 w t ⁢ η dec , ( 0 , i ) ⁢ b 0 , 1 + u 0 + 1 + i * +∑ t = 1 L + 1 ⁢ ∑ i = 1 w t ⁢ η dec , ( t , i ) ⁢ b t , n t + u t + i , * kL + 1 , ran , j ′ * := ∑ j = 1 2 ⁢ L ⁢ α ran , j ′ , j ⁢ k L , ran , j * +{ σ ran , j ′ ⁡ ( ∑ i = 1 n L + 1 ⁢ v L + 1 , i ⁢ k L , del , ( L + 1 , i ,0 ) * ) if ⁢ ⁢ ρ t = 0 σ ran , j ′ ( [ k L , del , ( L + 1 , i , 1 ) * ]L + if ⁢ ⁢ ρ t = 1 ∑ i = 1 n L + 1 ⁢ v L + 1 , i ⁡ [ k L , del , ( L + 1 , i, 1 ) * ] L ) } + ∑ i = 1 w t ⁢ η ran , j ′ , ( 0 , i ) ⁢ b 0 , 1 + u 0 +1 + i * + ∑ t = 1 L + 1 ⁢ ∑ i = 1 w t ⁢ η ran , j ′ , ( t , i ) ⁢ b t , nt + u t + i , * k L + 1 , ran , ( τ , ι , 0 ) * := ∑ j = 1 2 ⁢ L ⁢ α ran ,( τ , ι ) ⁢ j , ⁢ k L , ran , j * + ϕ ran , ( τ , ι , 0 ) ⁢ k L , ran , ( τ, ι , 0 ) * + { σ ran , ( τ , ι , 0 ) ⁡ ( ∑ i = 1 n L + 1 ⁢ v L + 1 , i ⁢ kL , del , ( L + 1 , i , 0 ) * ) if ⁢ ⁢ ρ t = 0 σ ran , ( τ , ι , 0 ) ( [ kL , del , ( L + 1 , i , 1 ) * ] L + if ⁢ ⁢ ρ t = 1 ∑ i = 1 n L + 1 ⁢ v L +1 , i ⁡ [ k L , del , ( L + 1 , i , 1 ) * ] L ) } + ∑ i = 1 w t ⁢ η del ,( τ , ι , 0 ) , ( 0 , i ) ⁢ b 0 , 1 + u 0 + 1 + i * + ∑ t = 1 L + 1 ⁢ ∑ i= 1 w t ⁢ η del , ( τ , ι , 0 ) , ( t , i ) ⁢ b t , n t + u t + i * + ∑ i= 1 w τ ⁢ η del , ( τ , ι , 0 ) , ( τ , i ) ⁢ b τ , n τ + u τ + i * , kL + 1 , del , ( τ , ι , 0 ) * := ∑ j = 1 2 ⁢ L ⁢ α del , ( τ , ι , 0 ) , j⁢k L , ran , j * + ϕ del , ( τ , ι , 0 ) ⁢ k L , ran ⁡ ( τ , ι , 0 ) * + ψ0 ⁢ k L , del ⁡ ( τ , ι , 0 ) * + { σ del , ( τ , ι , 0 ) ⁡ ( ∑ i = 1 n L +1 ⁢ v L + 1 , i ⁢ k L , del , ( L + 1 , i , 0 ) * ) if ⁢ ⁢ ρ t = 0 σ del , (τ , ι , 0 ) ( [ k L , del , ( L + 1 , i , 1 ) * ] L + if ⁢ ⁢ ρ t = 1 ∑ i =1 n L + 1 ⁢ v L + 1 , i ⁡ [ k L , del , ( L + 1 , i , 1 ) * ] L ) } + ∑ i= 1 w t ⁢ η del , ( τ , ι , 0 ) , ( 0 , i ) ⁢ b 0 , 1 + u 0 + 1 + i * + ∑t = 1 L + 1 ⁢ ∑ i = 1 w t ⁢ η del , ( τ , ι , 0 ) , ( t , i ) ⁢ b t , n t +u t + i * + ∑ i = 1 w τ ⁢ η del , ( τ , ι , 0 ) , ( τ , i ) ⁢ b τ , n τ +u τ + i * , [ Formula ⁢ ⁢ 180 ] k L + 1 , del , ( τ , ι , 1 ) * := ∑ j = 12 ⁢ L ⁢ α del , ( τ , ι , 1 ) , j ⁢ k L , ran , j * + ψ 1 ⁢ k L , del ⁡ ( τ ,ι , 1 ) * + { σ del , ( τ , ι , 1 ) ⁡ ( ∑ i = 1 n L + 1 ⁢ v L + 1 , i ⁢ k L, del , ( L + 1 , i , 0 ) * ) if ⁢ ⁢ ρ t = 0 σ del , ( τ , ι , 1 ) ( [ k L, del , ( L + 1 , i , 1 ) * ] L + if ⁢ ⁢ ρ t = 1 ∑ i = 1 n L + 1 ⁢ v L + 1, i ⁡ [ k L , del , ( L + 1 , i , 1 ) * ] L ) } + ∑ i = 1 w t ⁢ η del , (τ , ι , 1 ) , ( 0 , i ) ⁢ b 0 , 1 + u 0 + 1 + i * + ∑ t = 1 L + 1 ⁢ ∑ i =1 w t ⁢ η del , ( τ , ι , 1 ) , ( t , i ) ⁢ b t , n t + u t + i * + ∑ i =1 w τ ⁢ η del , ( τ , ι , 1 ) , ( τ , i ) ⁢ b τ , n τ + u τ + i * , sk L +1 := ( ( ( v → 1 , ρ 1 ) , … ⁢ , ( v → L + 1 , ρ L + 1 ) ) ; ⁢ ⁢ k L + 1 ,dec * , { k L + 1 , ran , j ′ * } j ′ = 1 , … ⁢ , 2 ⁢ ( L + 1 ) , { k L +1 , ran , ( τ , ι , 0 ) * , k L + 1 , del , ( τ , ι , 0 ) * ,   k L + 1, del , ( τ , ι , 1 ) * } τ = L + 2 , … ⁢ , d ; ( τ , ι ) = ( τ , 1 ) , …⁢, ( τ , n τ ) ) , return ⁢ ⁢ sk L + 1 .

When the lower-level decryption device 300 executes the Dec algorithmusing the delegation key sk_(L+1), the session key K is computed bycomputing Formula 170 if the inner product of (v{right arrow over ( )}₁,. . . , v{right arrow over ( )}_(L+1)) and (x{right arrow over ( )}₁, .. . , x{right arrow over ( )}_(L+1)) is 0 in (S403) of FIG. 15.

As described above, the cryptographic processing system 10 according tothe second embodiment realizes the HPE scheme for inner products thatallows decryption if the inner product of the attribute information andthe predicate information is 0 for some portions and if the innerproduct of the attribute information and the predicate information isnot 0 for the remaining portions. Therefore, it is possible to set acombination of positive and negative conditions and so on, for example.

In the above description, dimensions u_(t), w_(t), and z_(t) (t=0, . . ., d) are provided for enhanced security. Therefore, at the cost ofreduced security, dimensions u_(t), w_(t), and z_(t) (t=0, . . . , d)may be omitted by setting u_(t), w_(t), and z_(t) (t=0, . . . , d)respectively to 0.

In the above description, 1+u₀+1+w₀+z₀ is set in N₀ andn_(t)+u_(t)+w_(t)+z_(t) is set in N_(t). However, 1+u₀+1+w₀+z₀ may bereplaced with 1+1+1+1+1 so that 5 is set in N₀, andn_(t)+u_(t)+w_(t)+z_(t) may be replaced with n_(t)+n_(t)+n_(t)+1 so that3n_(t)+1 is set in N_(t).

In this case, the KeyGen algorithm shown in Formulas 168 and 169 arerewritten as shown in Formulas 181 and 182.

$\begin{matrix}{{{KeyGen}( {{pk},{sk},( {{\overset{->}{v}}_{1},\rho_{1}} ),\ldots\mspace{14mu},( {{\overset{->}{v}}_{L},\rho_{L}} )} )}:=} & \lbrack {{Formula}\mspace{14mu} 181} \rbrack \\{\mspace{79mu}( {( {{( {v_{1,1},\ldots\mspace{14mu},v_{1},_{n_{1}}} ) \in {??}_{q}^{n_{1}}},{\rho_{1} \in \{ {0,1} \}}} ),\ldots\mspace{14mu},} } & \; \\{ \mspace{205mu}( {{( {v_{L,1},\ldots\mspace{14mu},v_{L,n_{L}}} ) \in {??}_{q}^{n_{L}}},{\rho_{L} \in \{ {0,1} \}}} ) ):} & \; \\{\;{{for}\mspace{79mu}{{j = 1},\ldots\mspace{14mu},{{2L};}}\mspace{79mu}{{\tau = {L + 1}},\ldots\mspace{14mu},{d;{( {\tau,l} ) = ( {\tau,1} )}},\ldots\mspace{14mu},{( {\tau,n_{\tau}} );}}}} & \; \\{\mspace{11mu}{{\psi,s_{{dec},t},{{s_{{ran},j,t}\overset{U}{\longleftarrow}{{??}_{q}( {{t = 1},\ldots\mspace{14mu},L} )}};}}\mspace{79mu}{\theta_{{dec},t},{\theta_{{ran},j,t}\overset{U}{\longleftarrow}{??}_{q}},}}} & \; \\{{\overset{->}{\eta}}_{{dec},t},{\overset{->}{\eta}}_{{ran},j,t},{\overset{->}{\eta}}_{{ran},0,t},{{{\overset{->}{\eta}}_{{del},0,t}\mspace{14mu}{{\overset{->}{\eta}}_{{del},1,t}\overset{U}{\longleftarrow}{??}_{q}^{w_{t}}}\mspace{14mu}( {{t = 0},\ldots\mspace{14mu},L} )};}} & \; \\{\mspace{11mu}{s_{{ran},0,t},s_{{del},0,t},{s_{{del},1,t}\overset{U}{\longleftarrow}{??}_{q}},\mspace{79mu}\theta_{{ran},0,t},\theta_{{del},0,t},{\theta_{{del},1,t}\overset{U}{\longleftarrow}{??}_{q}},}} & \; \\{{\overset{->}{\eta}}_{{ran},0,{({\tau,1})}},{\overset{->}{\eta}}_{{del},0,{({\tau,l})}},{{\overset{->}{\eta}}_{{del},1,{({\tau,l})}}\overset{U}{\longleftarrow}{??}_{q}^{n_{t}}},{( {{t = 0},\ldots\mspace{14mu},{L + 1}} );}} & \; \\{{s_{{dec},0}:={\sum\limits_{t = 1}^{L}s_{{dec},t}}},{s_{{ran},j,0}:={\sum\limits_{t = 1}^{L}s_{{ran},j,t}}},{s_{{ran},0,0}:={\sum\limits_{t = 1}^{L}s_{{ran},0,t}}},} & \; \\{\mspace{11mu}{{s_{{del},0,0}:={\sum\limits_{t = 1}^{L + 1}s_{{del},0,t}}},{s_{{del},1,0}:={\sum\limits_{t = 1}^{L + 1}s_{{del},1,t}}},}} & \; \\{k_{L,{dec}}^{*}:=( {( {{- s_{{dec},0}},0,1,\eta_{{dec},0},0} )_{{??}_{0}^{*}},} } & \; \\{ {{{\begin{Bmatrix}{( {{{s_{{dec},t}{\overset{->}{e}}_{t,1}} + {\theta_{{dec},t,}{\overset{->}{v}}_{t}}},0^{n_{t}},{\overset{->}{\eta}}_{{dec},t},0} )_{{??}_{t}^{*}},} & {{{if}\mspace{14mu}\rho_{t}} = 0} \\{( {{s_{{dec},t}{\overset{->}{v}}_{t}},0^{n_{t}},{\overset{->}{\eta}}_{{dec},t},0} )_{{??}_{t}^{*}},} & {{{if}\mspace{14mu}\rho_{t}} = 1}\end{Bmatrix}:t} = {1\ldots}}\mspace{14mu},L} ),} & \; \\{k_{L,{ran},j}^{*}:=( {( {{- s_{{ran},j,0}},0,0,\eta_{{ran},j,0},0} )_{{??}_{0}^{*}},} } & \; \\{\begin{Bmatrix}{( {{{s_{{ran},j,t}{\overset{->}{e}}_{t,1}} + {\theta_{{ran},j,t}{\overset{->}{v}}_{t}}},0^{n_{t}},{\overset{->}{\eta}}_{{ran},j,t},0} )_{{??}_{t}^{*}},} & {{{if}\mspace{14mu}\rho_{t}} = 0} \\{( {{s_{{ran},j,t}{\overset{->}{v}}_{t}},0^{n_{t}},{\overset{->}{\eta}}_{{ran},j,t},0} )_{{??}_{t}^{*}},} & {{{if}\mspace{14mu}\rho_{t}} = 1}\end{Bmatrix}:} & \; \\{ \mspace{464mu}{{t = 1},\ldots\mspace{14mu},L} ),} & \; \\{k_{L,{ran},{({\tau,l,0})}}^{*}:=( {( {{- s_{{ran},0,0}},0,0,\eta_{{ran},0,0},0} )_{{??}_{0}^{*}},} } & \lbrack {{Formula}\mspace{14mu} 182} \rbrack \\{\{ \begin{matrix}{( {{{s_{{ran},0,t}{\overset{->}{e}}_{t,1}} + {\theta_{{ran},0,t}{\overset{->}{v}}_{t}}},0^{n_{t}},{\overset{->}{\eta}}_{{ran},0,t},0} )_{{??}_{t}^{*}},} & {{{if}\mspace{14mu}\rho_{t}} = 0} \\{( {{s_{{ran},0,t}{\overset{->}{v}}_{t}},0^{n_{t}},{\overset{->}{\eta}}_{{ran},0,t},0} )_{{??}_{t}^{*}},} & {{{if}\mspace{14mu}\rho_{t}} = 1}\end{matrix} \}:} & \; \\{ \mspace{464mu}{{t = 1},\ldots\mspace{14mu},L} ),} & \; \\{ \mspace{11mu}( {{s_{{ran},0,{L + 1}}{\overset{->}{e}}_{\tau,1}},0^{n_{\tau}},{\overset{->}{\eta}}_{{ran},0,{({\tau,l})}},0} )_{{??}_{\tau}^{*}} ),} & \; \\{k_{L,{del},{({\tau,l,0})}}^{*}:=( {( {{- s_{{del},0,0}},0,0,\eta_{{del},0,0},0} )_{{??}_{0}^{*}},} } & \; \\{\{ \begin{matrix}{( {{{s_{{del},0,t}{\overset{->}{e}}_{t,1}} + {\theta_{{del},0,t}{\overset{->}{v}}_{t}}},0^{n_{t}},{\overset{->}{\eta}}_{{del},0,t},0} )_{{??}_{t}^{*}},} & {{{if}\mspace{14mu}\rho_{t}} = 0} \\{( {{s_{{del},0,t}{\overset{->}{v}}_{t}},0^{n_{t}},{\overset{->}{\eta}}_{{del},0,t},0} )_{{??}_{t}^{*}},} & {{{if}\mspace{14mu}\rho_{t}} = 1}\end{matrix} \}:} & \; \\{ \mspace{455mu}{{t = 1},\ldots\mspace{14mu},L} ),} & \; \\ \;( {{s_{{del},0,{L + 1}}{\overset{->}{e}}_{\tau,l}},{\psi\;{\overset{->}{e}}_{\tau,l}},0^{n_{\tau}},{\overset{->}{\eta}}_{{del},0,{({\tau,l})}},0} )_{{??}_{\tau}^{*}} ) & \; \\{k_{L,{del},{{({\tau,l,1})}:}}^{*}:=( {( {{- s_{{del},1,0}},0,0,\eta_{{del},1,0},0} )_{{??}_{0}^{*}},} } & \; \\{\{ \begin{matrix}{( {{{s_{{del},1,t}{\overset{->}{e}}_{t,1}} + {\theta_{{del},1,t}{\overset{->}{v}}_{t}}},0^{n_{t}},{\overset{->}{\eta}}_{{del},1,t},0} )_{{??}_{t}^{*}},} & {{{if}\mspace{14mu}\rho_{t}} = 0} \\{( {{s_{{del},1,t}{\overset{->}{v}}_{t}},0^{n_{t}},{\overset{->}{\eta}}_{{del},1,t},0} )_{{??}_{t}^{*}},} & {{{if}\mspace{14mu}\rho_{t}} = 1}\end{matrix} \}:} & \; \\{ \mspace{455mu}{{t = 1},\ldots\mspace{14mu},L} ),} & \; \\{ \;( {{s_{{del},1,{L + 1}}{\overset{->}{e}}_{\tau,l}},0^{n_{\tau}},{\overset{->}{\eta}}_{{del},1,{({\tau,l})}},0} )_{{??}_{\tau}^{*}} ),} & \; \\{{sk}_{L}:=} & \; \\{\mspace{40mu}{\begin{pmatrix}{{( {( {{\overset{->}{v}}_{1},\rho_{1}} ),\ldots\mspace{14mu},( {{\overset{->}{v}}_{L},\rho_{L}} )} );k_{L,{dec}}^{*}},\{ k_{L,{ran},j}^{*} \}_{{j = 1},\mspace{11mu}\ldots\mspace{14mu},{2L}},} \\\begin{Bmatrix}{k_{L,{ran},{({\tau,l,0})}}^{*},k_{L,{del},{({\tau,l,0})}}^{*},} \\k_{L,{del},{({\tau,l,1})}}^{*}\end{Bmatrix}_{{\tau = {L + 1}},\ldots\mspace{14mu},{d;{{({\tau,l})} = {({\tau,1})}}},\ldots\mspace{14mu},{({\tau,n_{\tau}})}}\end{pmatrix},}} & \; \\{\;{{return}\mspace{14mu}{{sk}_{L}.}}} & \;\end{matrix}$

The Delegate_(L) algorithm shown in Formulas 179 and 180 are rewrittenas shown in Formulas 183 and 184.

$\begin{matrix}{\mspace{79mu}{{{{Delegate}_{L}( {{pk},{sk}_{L},{( {{\overset{->}{v}}_{L + 1},\rho_{L + 1}} ):=( {( {v_{{L + 1},},\ldots\mspace{14mu},v_{{L + 1},n_{L + 1}}} ),\rho_{L + 1}} )}} )}:\mspace{20mu}{for}}\mspace{20mu}{{j = 1},\ldots\mspace{14mu},{{2L};}}\mspace{20mu}{{j^{\prime} = 1},\ldots\mspace{14mu},{{2( {L + 1} )};}}\mspace{20mu}{{\tau = {L + 2}},\ldots\mspace{14mu},{d;}}\mspace{20mu}{{( {\tau,l} ) = ( {\tau,1} )},\ldots\mspace{14mu},{( {\tau,n_{\tau}} );}}\mspace{20mu}{{t = 0},\ldots\mspace{14mu},{L + 1},{\tau;}}\mspace{20mu}{{( {t,i} ) = ( {t,1} )},\ldots\mspace{14mu},{( {t,n_{t}} );}}\mspace{20mu}{\alpha_{{dec},j},\sigma_{dec},\alpha_{{ran},j^{\prime},j},\sigma_{{ran},j^{\prime}},\alpha_{{ran},{({\tau,l,0})},j},\sigma_{{ran},{({\tau,l,0})}},\phi_{{ran},{({\tau,l,0})}},\mspace{20mu}{\alpha_{{del},{({\tau,l,0})},}\sigma_{{del},{({\tau,l,0})}}},\phi_{{del},{({\tau,l,0})}},\alpha_{{del},{({\tau,l,1})},j},\sigma_{{del},{({\tau,l,1})}},\phi_{{del},{({\tau,l,1})}},\mspace{20mu}\eta_{{dec},{({t,i})}},\eta_{{ran},j^{\prime},{({t,i})}},\eta_{{ran},{({\tau,l,0})},{({t,i})}},\eta_{{del},{({\tau,l,0})},{({t,i})}},\eta_{{del},{({\tau,l,1})},{({t,i})}},\mspace{20mu}\psi_{0},\psi_{1},{\overset{U}{\longleftarrow}{??}_{q}},}}} & \lbrack {{Formula}\mspace{14mu} 183} \rbrack \\{{k_{{L + 1},{dec}}^{*}:={k_{L,{dec}}^{*} + {\sum\limits_{j = 1}^{2L}{\alpha_{{dec},j}k_{L,{ran},j}^{*}}} + \begin{Bmatrix}( {\sigma_{dec}( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i,0})}}^{*}}} )}  & {{{if}\mspace{14mu}\rho_{t}} = 0} \\( {\sigma_{dec}( {\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \rbrack^{L} + {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \rbrack}_{L}}} )}  & {{{if}\mspace{14mu}\rho_{t}} = 1}\end{Bmatrix} + {\eta_{{dec},{({0,1})}}b_{0,4}^{*}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{n_{i}}{\eta_{{dec},{({t,i})}}b_{t,{{2n_{t}} + i},}^{*}}}}}}{{k_{{L + 1},{ran},j^{\prime}}^{*}:={{\sum\limits_{j = 1}^{2L}{\alpha_{{ran},j^{\prime},j}k_{L,{ran},j}^{*}}} + \begin{Bmatrix}{\sigma_{{ran},j^{\prime}}( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{{del}{({{L + 1},i,0})}}}^{*}}} )} & {{{if}\mspace{14mu}\rho_{t}} = 0} \\{\sigma_{{ran},j^{\prime}}( {\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \rbrack^{L} + {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \rbrack}_{L}}} )} & {{{if}\mspace{14mu}\rho_{t}} = 1}\end{Bmatrix} + {\eta_{{ran},j^{\prime},{({0,1})}}b_{0,4}^{*}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{n_{t}}{\eta_{{ran},j^{\prime},{({t,i})}}b_{t,{{2n_{t}} + i}}^{*}}}}}},}} & \; \\{{k_{{L + 1},{ran},{({\tau,l,0})}}^{*}:={\sum\limits_{j = 1}^{2L}\alpha_{{ran},{{({\tau,l})}j}}}},{k_{L,{ran},j}^{*} + {\phi_{{ran},{({\tau,l,0})}}k_{L,{ran},{({\tau,l,0})}}^{*}} + \begin{Bmatrix}{\sigma_{{ran},{({\tau,l,0})}}( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i,0})}}^{*}}} )} & {{{if}\mspace{14mu}\rho_{t}} = 0} \\{\sigma_{{ran},{({\tau,l,0})}}( {\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \rbrack^{L} + {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \rbrack}_{L}}} )} & {{{if}\mspace{14mu}\rho_{t}} = 1}\end{Bmatrix} + {\eta_{{del},{({\tau,l,0})},{({0,1})}}b_{0,4}^{*}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{n_{t}}{\eta_{{del},{({\tau,l,0})},{({t,i})}}b_{t,{{2n_{t}} + i}}^{*}}}} + {\sum\limits_{i = 1}^{n_{\tau}}{\eta_{{del},{({\tau,l,0})},{({\tau,i})}}b_{\tau,{{2n_{\tau}} + i}}^{*}}}},} & \; \\{{{k_{{L + 1},{del},{({\tau,l,0})}}^{*}:={{\sum\limits_{j = 1}^{2L}{\alpha_{{del},{({\tau,l,0})},j}k_{L,{ran},j}^{*}}} + {\phi_{{del},{({\tau,l,0})}}k_{L,{{ran}{({\tau,l,0})}}}^{*}} + {\psi_{0}k_{L,{{del}{({\tau,l,0})}}}^{*}} + \begin{Bmatrix}{\sigma_{{del},{({\tau,l,0})}}( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i,0})}}^{*}}} )} & {{{if}\mspace{14mu}\rho_{t}} = 0} \\{\sigma_{{del},{({\tau,l,0})}}( {\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \rbrack^{L}{\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \rbrack}_{L}}} )} & {{{if}\mspace{14mu}\rho_{t}} = 1}\end{Bmatrix} + {\eta_{{del},{({\tau,l,0})},{({0,1})}}b_{0,4}^{*}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{n_{t}}{\eta_{{del},{({\tau,l,0})},{({t,i})}}b_{t,{{2n_{t}} + i}}^{*}}}} + {\sum\limits_{i = 1}^{n_{\tau}}{\eta_{{del},{({\tau,l,0})},{({\tau,i})}}b_{\tau,{{2n_{\tau}} + i}}^{*}}}}},{k_{{L + 1},{del},{({\tau,l,1})}}^{*}:={{\sum\limits_{j = 1}^{2L}{\alpha_{{{del}{({\tau,l,1})}},j}k_{L,{ran},j}^{*}}} + {\psi_{1}k_{L,{{del}{({\tau,l,1})}}}^{*}} + \begin{Bmatrix}{\sigma_{{del},{({\tau,l,1})}}( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i,0})}}^{*}}} )} & {{{if}\mspace{14mu}\rho_{t}} = 0} \\{\sigma_{{del},{({\tau,l,1})}}( {\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \rbrack^{L} + {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \rbrack}_{L}}} )} & {{{if}\mspace{14mu}\rho_{t}} = 1}\end{Bmatrix} + {\eta_{{del},{({\tau,l,1})},{({0,1})}}b_{0,4}^{*}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{n_{t}}{\eta_{{del},{({\tau,l,1})},{({t,i})}}b_{t,{{2n_{t}} + i}}^{*}}}} + {\sum\limits_{i = 1}^{n_{\tau}}{\eta_{{del},{({\tau,l,1})},{({\tau,i})}}b_{\tau,{{2n_{\tau}} + i}}^{*}}}}},{{sk}_{L + 1}:=( {{( {( {{\overset{->}{v}}_{1},\rho_{1}} ),\ldots\mspace{14mu},( {{\overset{->}{v}}_{L + 1},\rho_{L + 1}} )} );k_{{L + 1},{dec}}^{*}},\{ k_{{L + 1},{ran},j^{\prime}}^{*} \}_{{j^{\prime} = 1},\mspace{11mu}\ldots\mspace{14mu},{2{({L + 1})}}},\{ {k_{{L + 1},{ran},{({\tau,l,0})}}^{*},k_{{L + 1},{del},{({\tau,l,0})}}^{*},k_{{L + 1},{del},{({\tau,l,1})}}^{*}} \}_{{\tau = {L + 2}},\mspace{11mu}\ldots\mspace{14mu},{d;{{({\tau,l})} = {({\tau,1})}}},\mspace{11mu}\ldots\mspace{14mu},{({\tau,n_{\tau}})}}} )},\mspace{20mu}{{return}\mspace{14mu}{{sk}_{L + 1}.}}}\mspace{214mu}} & \lbrack {{Formula}\mspace{14mu} 184} \rbrack\end{matrix}$

The Dec algorithm shown in Formula 172 remains the same.

The Setup algorithm needs to be executed once when the cryptographicprocessing system 10 is set up, and does not have to be executed eachtime a decryption key is generated. In the above description, the Setupalgorithm and the KeyGen algorithm are executed by the key generationdevice 100. However, the Setup algorithm and the KeyGen algorithm may beexecuted by different devices.

Third Embodiment

In the above embodiments, the methods for implementing the cryptographicprocesses in dual vector spaces have been described. In this embodiment,a method for implementing the cryptographic processes in dual moduleswill be described.

That is, in the above embodiments, the cryptographic processes areimplemented in cyclic groups of prime order q. However, when a ring R isexpressed using a composite number M as shown in Formula 185, thecryptographic processes described in the above embodiments can beadapted to a module having the ring R as a coefficient.

/M

  [Formula 185]where

-   : integer,-   M: composite number.

When the HPE scheme described in the first embodiment is implemented inthe module having the R as the coefficient, the HPE scheme isrepresented as shown in Formulas 186 to 193.

$\begin{matrix}{{{{Setup}( {1^{\lambda},{\overset{->}{n}:=( {{d;n_{1}},\ldots\mspace{14mu},n_{d},u_{0},\ldots\mspace{14mu},u_{d},w_{0},\ldots\mspace{14mu},w_{d},z_{0},\ldots\mspace{14mu},z_{d}} )}} )}:{{( {{param}_{\overset{->}{n}},\{ {{??}_{t},{??}_{t}^{*}} \}_{{t = 0},\mspace{11mu}\ldots\mspace{14mu},d}} )\overset{R}{\longleftarrow}{??}_{ob}}( {1^{\lambda},\overset{->}{n}} )}},} & \lbrack {{Formula}\mspace{14mu} 186} \rbrack \\{{{\hat{??}}_{0}:=( {b_{0,1},b_{0,{1 + u_{0} + 1}},b_{0,{1 + u_{0} + 1 + w_{0} + 1}},\ldots\mspace{14mu},b_{0,{1 + u_{0} + 1 + w_{0} + z_{0}}}} )},} & \; \\{{\hat{??}}_{t}:=( {b_{t,1},\ldots\mspace{14mu},b_{t,n_{t}},b_{t,{n_{t} + u_{t} + w_{t} + 1}},\ldots\mspace{14mu},b_{t,{n_{t} + u_{t} + w_{t} + z_{t}}}} )} & \; \\{\;{{{{for}\mspace{14mu} t} = 1},\ldots\mspace{14mu},d,\mspace{79mu}{{\hat{??}}_{0}^{*}:=( {b_{0,1}^{*},b_{0,{1 + u_{0} + 1}}^{*}} )},\mspace{79mu}{{\hat{??}}_{t}^{*}:={{( {b_{t,1}^{*},\ldots\mspace{14mu},b_{t,n_{t}}^{*}} )\mspace{79mu}{for}\mspace{14mu} t} = 1}},\ldots\mspace{14mu},d,}} & \; \\{{{pk}:=( {1^{\lambda},{param}_{\overset{->}{n}},\{ {\hat{??}}_{t} \}_{{t = 0},\mspace{11mu}\ldots\mspace{14mu},d},b_{0,{1 + u_{0} + 1 + 1}}^{*},\ldots\mspace{14mu},b_{0,{1 + u_{0} + 1 + w_{0}}}^{*},\{ {b_{t,{n_{t} + u_{t} + 1}}^{*},\ldots\mspace{14mu},b_{t,{n_{t} + u_{t} + w_{t}}}^{*}} \}_{{t = 1},\mspace{11mu}\ldots\mspace{14mu},d}} )},} & \; \\{\;{{{sk}:=\{ {\hat{??}}_{t}^{*} \}_{{t = 0},\mspace{11mu}\ldots\mspace{14mu},d}},\mspace{79mu}{{return}\mspace{14mu}{pk}},{{sk}.}}} & \; \\{{??}_{ob}( {1^{\lambda},{\overset{->}{n}:=( {d;{\overset{->}{n}:=( {{d;n_{1}},\ldots\mspace{14mu},n_{d},u_{0},\ldots\mspace{14mu},u_{d},w_{0},\ldots\mspace{14mu},w_{d},z_{0},\ldots\mspace{14mu},z_{d}} )}} }} } & \lbrack {{Formula}\mspace{14mu} 187} \rbrack \\{{N_{0}:={1 + u_{0} + 1 + w_{0} + z_{0}}},{N_{t}:={n_{t} + u_{t} + w_{t} + z_{t}}}} & \; \\{{{{for}\mspace{14mu} t} = 1},\ldots\mspace{14mu},d,\mspace{79mu}{{param}_{??}:={{( {q,{??},{??}_{T},g,e} )\overset{R}{\longleftarrow}{??}_{bpg}}( 1^{\lambda} )}},} & \; \\{\;{{\psi\overset{U}{\longleftarrow}{\mathbb{R}}^{x}},\mspace{79mu}{{{For}\mspace{14mu} t} = 0},\ldots\mspace{14mu},d,}} & \; \\{{{param}_{{??}_{t}}:={( {q,{??}_{t},{??}_{T},{??}_{t},e} ):={{??}_{dpvs}( {1^{\lambda},N_{t},{param}_{??}} )}}},} & \; \\{{X_{t}:={( \chi_{i,i,j} )_{i,j}\overset{U}{\longleftarrow}{{GL}( {N_{t},{\mathbb{R}}} )}}},{( v_{t,i,j} )_{i,j}:={\varphi \cdot ( X_{t}^{T} )^{- 1}}},} & \; \\{{b_{t,i}:={( {\chi_{t,i,1},\ldots\mspace{14mu},\chi_{t,i,N_{t}}} )_{{??}_{t}} = {\sum\limits_{j = 1}^{N_{t}}{\chi_{t,i,j}a_{t,j}}}}},} & \; \\{{{??}_{t}:=( {b_{t,1},\ldots\mspace{14mu},b_{t,N_{t}}} )},} & \; \\{{b_{t,i}^{*}:={( {v_{t,i,1},\ldots\mspace{14mu},v_{t,i,N_{t}}} )_{{??}_{t}} = {\sum\limits_{j = 1}^{N_{t}}{v_{t,i,j}a_{t,j}}}}},} & \; \\{{{??}_{t}^{*}:=( {b_{t,1}^{*},\ldots\mspace{14mu},b_{t,N_{t}}^{*}} )},{g_{T}:={e( {g,g} )}^{\psi}},} & \; \\{{param}_{\overset{->}{n}}:=( {\{ {param}_{{??}_{t}} \}_{{t = 0},\mspace{11mu}\ldots\mspace{14mu},d,}g_{T}} )} & \; \\{\;{{return}\mspace{14mu}{( {{param}_{\overset{->}{n}},\{ {{??}_{t},{??}_{t}^{*}} \}_{{t = 0},\mspace{11mu}\ldots\mspace{14mu},d}} ).}}} & \; \\{{{KeyGen}( {{pk},{sk},{( {{\overset{->}{v}}_{1},\ldots\mspace{14mu},{\overset{->}{v}}_{L}} ):=( {v_{1,1},\ldots\mspace{14mu},v_{1,n_{1}}} )},\ldots\mspace{14mu},( {v_{L,1},\ldots\mspace{14mu},v_{L,n_{L}}} )} )}:} & \lbrack {{Formula}\mspace{14mu} 188} \rbrack \\{{{{{for}\mspace{14mu} j} = 1},\ldots\mspace{14mu},{{2L};}}\mspace{79mu}{{\tau = {L + 1}},\ldots\mspace{14mu},{d;}}\mspace{79mu}{{( {\tau,l} ) = ( {\tau,1} )},\ldots\mspace{14mu},{( {\tau,n_{\tau}} );}}} & \; \\{\mspace{11mu}{\psi,s_{{dec},t},{{{s_{{ran},j,t}\overset{U}{\longleftarrow}{\mathbb{R}}}( {{t = 1},\ldots\mspace{14mu},L} )};}}} & \; \\{\theta_{{dec},t},{\theta_{{ran},j,t}\overset{U}{\longleftarrow}{\mathbb{R}}},{\overset{->}{\eta}}_{{dec},t},{{{\overset{->}{\eta}}_{{ran},j,t}\overset{U}{\longleftarrow}{{\mathbb{R}}^{w_{t}}( {{t = 0},\ldots\mspace{14mu},L} )}};}} & \; \\{\;{s_{{ran},{({\tau,l})},t},{{{s_{{del},{({\tau,l})},t}\overset{U}{\longleftarrow}{\mathbb{R}}}( {{t = 1},\ldots\mspace{14mu},{L + 1}} )};}}} & \; \\{\theta_{{ran},{({\tau,l})},t},{\theta_{{del},{({\tau,l})},t}\overset{U}{\longleftarrow}{\mathbb{R}}},{\overset{->}{\eta}}_{{ran},{({\tau,l})},t},} & \; \\{{{\overset{->}{\eta}}_{{del},{({\tau,l})},t}\overset{U}{\longleftarrow}{\mathbb{R}}^{w_{t}}},{( {{t = 0},\ldots\mspace{14mu},{L + 1}} );}} & \; \\{{s_{{dec},0}:={\sum\limits_{t = 1}^{L}s_{{dec},t}}},{s_{{ran},j,0}:={\sum\limits_{t = 1}^{L}s_{{ran},j,t}}},} & \; \\{{s_{{ran},{({\tau,l})},0}:={\sum\limits_{t = 1}^{L + 1}s_{{ran},{({\tau,l})},t}}},{s_{{del},{({\tau,l})},0}:={\sum\limits_{t = 1}^{L + 1}s_{{del},{({\tau,l})},t}}},} & \; \\{k_{L,{dec}}^{*}:=( {( {{- s_{{dec},0}},0^{u_{0}},1,{\overset{->}{\eta}}_{{dec},0},0^{z_{0}}} )_{{??}_{0}^{*}},} } & \lbrack {{Formula}\mspace{14mu} 189} \rbrack \\{ {{{( {{{s_{{dec},t}{\overset{->}{e}}_{t,1}} + {\theta_{{dec},t}{\overset{->}{v}}_{t}}},0^{u_{t}},{\overset{->}{\eta}}_{{dec},t},0^{z_{t}}} )_{{??}_{t}^{*}}:t} = 1},\ldots\mspace{14mu},L} ),} & \; \\{k_{L,{ran},j}^{*}:=( {( {{- s_{{ran},j,0}},0^{u_{0}},0,{\overset{->}{\eta}}_{{ran},j,0},0^{z_{0}}} )_{{??}_{0}^{*}},} } & \; \\{ {{( {{{s_{{ran},j,t}{\overset{->}{e}}_{t,1}} + {\theta_{{ran},j,t}{\overset{->}{v}}_{t}}},0^{u_{t}},{\overset{->}{\eta}}_{{ran},j,t},0^{z_{t}}} )_{{??}_{t}^{*}}:{t - 1}},\ldots\mspace{14mu},L} ),} & \; \\{k_{L,{ran},{({\tau,l})}}^{*}:=( {( {{- s_{{ran},{({\tau,l})},0}},0^{u_{0}},0,{\overset{->}{\eta}}_{{ran},{({\tau,l})},0},0^{z_{0}}} )_{{??}_{0}^{*}},{{( {{{s_{{ran},{({\tau,l})},t}{\overset{->}{e}}_{t,1}} + {\theta_{{ran},{({\tau,l})},t}{\overset{->}{v}}_{t}}},0^{u_{t}},{\overset{->}{\eta}}_{{ran},{({\tau,l})},t},0^{z_{t}}} )_{{??}_{t}^{*}}:t} =}} } & \; \\{ {1,\ldots\mspace{14mu},{L( {{s_{{ran},{({\tau,l})},{L + 1}}{\overset{->}{e}}_{\tau,1}},0^{u_{\tau}},{\overset{->}{\eta}}_{{ran},{({\tau,l})},{L + 1}},0^{z_{\tau}}} )}_{{??}_{\tau}^{*}}} ),} & \; \\{k_{L,{del},{({\tau,l})}}^{*}:=( {( {{- s_{{del},{({\tau,l})},0}},0^{u_{0}},0,{\overset{->}{\eta}}_{{del},{({\tau,l})},0},0^{z_{0}}} )_{{??}_{0}^{*}},} } & \; \\{{{( {{{s_{{del},{({\tau,t})},t}{\overset{->}{e}}_{t,1}} + {\theta_{{del},{({\tau,l})},t}{\overset{->}{v}}_{t}}},0^{u_{t}},{\overset{->}{\eta}}_{{del},{({\tau,l})},t},0^{z_{t}}} )_{{??}_{t}^{*}}:t} = 1},\ldots\mspace{14mu},} & \; \\{ {L( {{{s_{{del},{({\tau,l})},{L + 1}}{\overset{->}{e}}_{\tau,1}} + {\psi\;{\overset{->}{e}}_{\tau,l}}},0^{u_{\tau}},{\overset{->}{\eta}}_{{del},{({\tau,l})},{L + 1}},0^{z_{\tau}}} )_{{??}_{\tau}^{*}}} ),} & \; \\{{{sk}_{L}:=( {k_{L,{dec}}^{*},\{ k_{L,{ran},j}^{*} \}_{{j = 1},\mspace{11mu}\ldots\mspace{14mu},{2L}},\{ k_{L,{ran},{({\tau,l})}}^{*} \}_{{\tau = {L + 1}},\mspace{11mu}\ldots\mspace{14mu},{d;{{({\tau,l})} = {({\tau,1})}}},\mspace{11mu}\ldots\mspace{14mu},{({\tau,n_{\tau}})}},\{ k_{L,{del},{({\tau,l})}}^{*} \}_{{\tau = {L + 1}},\mspace{11mu}\ldots\mspace{14mu},{d;{{({\tau,1})} = {({\tau,1})}}},\mspace{11mu}\ldots\mspace{14mu},{({\tau,n_{\tau}})}}} )},} & \; \\{{{return}\mspace{14mu}{{sk}_{L}.}}\mspace{11mu}} & \; \\{{Enc}( {{pk},{m \in {??}_{T}},{{( {{\overset{->}{x}}_{1},\ldots\mspace{14mu},{\overset{->}{x}}_{L}} ):={( {( {x_{1,1},\ldots\mspace{14mu},x_{1,n_{1}}} ),\ldots\mspace{14mu},( {x_{L,1},\ldots\mspace{14mu},x_{L,n_{L}}} )} ):{{( {{\overset{->}{x}}_{L + 1},\ldots\mspace{14mu},{\overset{->}{x}}_{d}} )\overset{U}{\longleftarrow}{\mathbb{R}}^{n_{L + 1}}} \times \ldots \times {\mathbb{R}}^{n_{d}}}}};}} } & \lbrack {{Formula}\mspace{14mu} 190} \rbrack \\{\;{\omega,{\zeta\overset{U}{\longleftarrow}{\mathbb{R}}},{{{\overset{->}{\varphi}}_{t}\overset{U}{\longleftarrow}{\mathbb{R}}^{z_{t}}}( {{t = 0},\ldots\mspace{14mu},d} )},}} & \; \\{{c_{1}:=( {( {\omega,0^{u_{0}},\zeta,0^{w_{0}},{\overset{->}{\varphi}}_{0}} )_{{??}_{0}},{{( {{\omega\;{\overset{->}{x}}_{t}},0^{u_{t}},0^{w_{t}},{\overset{->}{\varphi}}_{t}} )_{{??}\; t}:t} = 1},\ldots\mspace{14mu},d} )},} & \; \\{{c_{2}:={g_{T}^{\zeta}m}},\mspace{59mu}\mspace{79mu}{{ct}:=( {c_{1},c_{2}} )},\mspace{79mu}{{return}\mspace{14mu}{{ct}.}}} & \; \\{\;{{{{{Dec}( {{pk},k_{L,{dec}}^{*},{ct}} )}:m^{\prime}}:={c_{2}/{e( {c_{1},k_{L,{dec}}^{*}} )}}}\mspace{79mu}{{return}\mspace{14mu}{m^{\prime}.}}}} & \lbrack {{Formula}\mspace{14mu} 191} \rbrack \\{{{Delegate}_{L}( {{pk},{sk}_{L},{{\overset{->}{v}}_{L + 1}:=( {v_{{L + 1},1},\ldots\mspace{14mu},v_{{L + 1},n_{L + 1}}} )}} )};} & \lbrack {{Formula}\mspace{14mu} 192} \rbrack \\{{for}\mspace{79mu}{{j = 1},\ldots\mspace{14mu},{{2L};}}\mspace{79mu}{{j^{\prime} = 1},\ldots\mspace{14mu},{{2( {L + 1} )};}}\mspace{79mu}{{\tau = {L + 2}},\ldots\mspace{14mu},{d;}}} & \; \\{\mspace{11mu}{{{( {\tau,l} ) = ( {\tau,l} )},\ldots\mspace{14mu},{( {\tau,n_{\tau}} );}}\mspace{79mu}{{t = 0},\ldots\mspace{14mu},{L + 1},{\tau;}}\mspace{79mu}{{( {t,i} ) = ( {t,1} )},\ldots\mspace{14mu},{( {t,w_{t}} );}}\mspace{79mu}{\alpha_{{dec},j},\sigma_{dec},\alpha_{{ran},j^{\prime},j},\sigma_{{ran},j^{\prime}},\alpha_{{ran},{({\tau,l})},j},\sigma_{{ran},{({\tau,l})}},}}} & \; \\{\mspace{11mu}{\phi_{{ran},{({\tau,l})}},\alpha_{{del},{({\tau,l})},j},\sigma_{{del},{({\tau,l})}},\phi_{{del},{({\tau,l})}},\psi^{\prime},\mspace{79mu}\eta_{{dec},{({t,i})}},\eta_{{ran},{({t,i})}},\eta_{{ran},{({\tau,l})},{({t,i})}},{\eta_{{del},{({\tau,l})},{({t,i})}}\overset{U}{\longleftarrow}{\mathbb{R}}},}} & \; \\{{k_{{L + 1},{dec}}^{*}:={k_{L,{dec}}^{*} + {\sum\limits_{j = 1}^{2L}{\alpha_{{dec},j}k_{L,{ran},j}^{*}}} + {\sigma_{dec}( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i})}}^{*}}} )} + {\sum\limits_{i = 1}^{w_{i}}{\eta_{{dec},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{i}}{\eta_{{dec},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}}}},} & \lbrack {{Formula}\mspace{14mu} 193} \rbrack \\{{k_{{L + 1},{ran},j^{\prime}}^{*}:={{\sum\limits_{j = 1}^{2L}{\alpha_{{ran},j^{\prime},j}k_{L,{ran},j}^{*}}} + {\sigma_{{ran},j^{\prime}}( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i})}}^{*}}} )} + {\sum\limits_{i = 1}^{w_{t}}{\eta_{{ran},j^{\prime},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{i}}{\eta_{{ran},j^{\prime},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}}}},} & \; \\{{k_{{L + 1},{ran},{({\tau,l})}}^{*}:={{\sum\limits_{j = 1}^{2L}{\alpha_{{ran},{({\tau,l})},j}k_{L,{ran},j}^{*}}} + {\sigma_{{ran},{({\tau,l})}}( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i})}}^{*}}} )} + {\phi_{{ran},{({\tau,l})}}k_{L,{ran},{({\tau,l})}}^{*}} + {\sum\limits_{i = 1}^{w_{t}}{\eta_{{ran},{({\tau,l})},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{i}}{\eta_{{ran},{({\tau,l})},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}} + {\sum\limits_{i = 1}^{w_{\tau}}{\eta_{{ran},{({\tau,l})},{({\tau,i})}}b_{\tau,{n_{\tau} + u_{\tau} + i}}^{*}}}}},} & \; \\{{k_{{L + 1},{del},{({\tau,l})}}^{*}:={{\sum\limits_{j = 1}^{2L}{\alpha_{{del},{({\tau,i})},j}k_{L,{ran},j}^{*}}} + {\sigma_{{del},{({\tau,l})}}( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i})}}^{*}}} )} + {\psi^{\prime}k_{L,{del},{({\tau,l})}}^{*}} + {\phi_{{del},{({\tau,l})}}k_{L,{{ran}{({\tau,l})}}}^{*}} + {\sum\limits_{i = 1}^{w_{t}}{\eta_{{del},{({\tau,l})},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{del},{({\tau,l})},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}} + {\sum\limits_{i = 1}^{w_{\tau}}{\eta_{{del},{({\tau,l})},{({\tau,i})}}b_{\tau,{n_{\tau} + u_{\tau} + i}}^{*}}}}},} & \; \\{{{sk}_{L + 1}:=( {k_{{L + 1},{dec}}^{*},\{ k_{{L + 1},{ran},j^{\prime}}^{*} \}_{{j^{\prime} = 1},\mspace{11mu}\ldots\mspace{14mu},{2{({L + 1})}}},\{ {k_{{L + 1},{ran},{({\tau,l})}}^{*},k_{{L + 1},{del},{({\tau,l})}}^{*}} \}_{{\tau = {L + 2}},\mspace{11mu}\ldots\mspace{14mu},{d;{{({\tau,l})} = {({\tau,1})}}},\mspace{11mu}\ldots\mspace{14mu},{({\tau,n_{\tau}})}}} )},\mspace{79mu}{{return}\mspace{14mu}{sk}_{L + 1}}} & \;\end{matrix}$

When the HPE scheme described in the second embodiment is implemented inthe module having the ring R as the coefficient, the HPE scheme isexpressed as shown in Formulas 194 to 199. The Setup algorithm and theG_(ob) algorithm are as shown in Formulas 186 and 187 respectively.

$\begin{matrix}{{{{KeyGen}( {{pk},{sk},( {{\overset{->}{v}}_{1},\rho_{1}} ),\ldots\mspace{14mu},( {{\overset{->}{v}}_{L},\rho_{L}} )} )}:={( {( {{( {v_{1,1},\ldots\mspace{14mu},v_{1,n_{1}}} ) \in {\mathbb{R}}^{n_{1}}},{\rho_{1} \in \{ {0,1} \}}} ),\ldots\mspace{14mu},( {{( {v_{L,1},\ldots\mspace{14mu},v_{L,n_{L}}} ) \in {\mathbb{R}}^{n_{L}}},{\rho_{L} \in \{ {0,1} \}}} )} ):\mspace{20mu}{for}}}\mspace{20mu}{{j = 1},\ldots\mspace{14mu},{{2L};}}\mspace{20mu}{{\tau = {L + 1}},\ldots\mspace{14mu},{d;}}\mspace{20mu}{{( {\tau,l} ) = ( {\tau,1} )},\ldots\mspace{14mu},{( {\tau,n_{\tau}} );}}\mspace{20mu}{\psi,s_{{dec},t},{{s_{{ran},j,t}\overset{U}{\longleftarrow}{{\mathbb{R}}( {{t = 1},\ldots\mspace{14mu},L} )}};}}\mspace{20mu}{\theta_{{dec},t},{\theta_{{ran},j,t}\overset{U}{\longleftarrow}{\mathbb{R}}},\mspace{20mu}{\overset{->}{\eta}}_{{dec},t},{\overset{->}{\eta}}_{{ran},j,t},{\overset{->}{\eta}}_{{ran},0,t},{{{\overset{->}{\eta}}_{{del},0,t}{{\overset{->}{\eta}}_{{del},1,t}\overset{U}{\longleftarrow}{\mathbb{R}}^{w_{t}}}\mspace{14mu}( {{t = 0},\ldots\mspace{14mu},L} )};}}\mspace{20mu}{s_{{ran},0,t},s_{{del},0,t},{s_{{del},1,t}\overset{U}{\longleftarrow}{\mathbb{R}}},\mspace{20mu}\theta_{{ran},0,t},\theta_{{del},0,t},{\theta_{{del},1,t}\overset{U}{\longleftarrow}{\mathbb{R}}},}} & \lbrack {{Formula}\mspace{14mu} 194} \rbrack \\{\mspace{79mu}{{{\overset{->}{\eta}}_{{ran},0,{({\tau,l})}},{\overset{–}{\eta}}_{{del},0,{({\tau,l})}},{{\overset{->}{\eta}}_{{del},1,{({\tau,l})}}\overset{U}{\longleftarrow}{\mathbb{R}}^{w_{t}}},{( {{t = 0},\ldots\mspace{14mu},{L + 1}} );}}\mspace{20mu}{{s_{{dec},0}:={\sum\limits_{t = 1}^{L}s_{{dec},t}}},{s_{{ran},j,0}:={\sum\limits_{t = 1}^{L}s_{{ran},j,t}}},{s_{{ran},0,0}:={\sum\limits_{t = 1}^{L}s_{{ran},0,t}}},\mspace{20mu}{s_{{del},0,0}:={\sum\limits_{t = 1}^{L + 1}s_{{del},0,t}}},{s_{{del},1,0}:={\sum\limits_{t = 1}^{L + 1}s_{{del},1,t}}},\mspace{20mu}{k_{L,{dec}}^{*}:=( {( {{- s_{{dec},0}},0^{u_{0}},1,{\overset{->}{\eta}}_{{dec},0},0^{z_{0}}} )_{{??}_{0}^{*}},{{\begin{Bmatrix}{( {{{s_{{dec},t}{\overset{->}{e}}_{t,1}} + {\theta_{{dec},t,}{\overset{->}{v}}_{t}}},0^{u_{t}},{\overset{->}{\eta}}_{{dec},t},0^{z_{t}}} )_{{??}_{t}^{*}},} & {{{if}\mspace{14mu}\rho_{t}} = 0} \\{( {{s_{{dec},t}{\overset{->}{v}}_{t}},0^{u_{t}},{\overset{->}{\eta}}_{{dec},t},0^{z_{t}}} )_{{??}_{t}^{*}},} & {{{if}\mspace{14mu}\rho_{t}} = 1}\end{Bmatrix}:t} = 1},\ldots\mspace{14mu},L} )},\mspace{20mu}{k_{L,{ran},j}^{*}:=( {( {{- s_{{ran},j,0}},0^{u_{0}},0,{\overset{->}{\eta}}_{{ran},j,0},0^{z_{0}}} )_{{??}_{0}^{*}},{{\{ \begin{matrix}{( {{{s_{{ran},j,t}{\overset{->}{e}}_{t,1}} + {\theta_{{ran},j,t}{\overset{->}{v}}_{t}}},0^{u_{t}},{\overset{->}{\eta}}_{{ran},j,t},0^{z_{t}}} )_{{??}^{*t}},} & {{{if}\mspace{14mu}\rho_{t}} = 0} \\{( {{s_{{ran},j,t}{\overset{->}{v}}_{t}},0^{u_{t}},{\overset{->}{\eta}}_{{ran},j,t},0^{z_{t}}} )_{{??}_{t}^{*}},} & {{{if}\mspace{14mu}\rho_{t}} = 1}\end{matrix} \}:t} = 1},\ldots\mspace{14mu},L} )},}}} & \; \\{ { \mspace{79mu}{{k_{L,{ran},{({\tau,l,0})}}^{*}:=( {( {{- s_{{ran},0,0}},0^{u_{0}},0,{\overset{->}{\eta}}_{{ran},0,0},0^{z_{0}}} )_{{??}_{0}^{*}},{{\{ \begin{matrix}{( {{{s_{{ran},0,t}{\overset{->}{e}}_{t,1}} + {\theta_{{ran},0,t}{\overset{->}{v}}_{t}}},0^{u_{t}},{\overset{->}{\eta}}_{{ran},0,t},0^{z_{t}}} )_{{??}_{t}^{*}},} & {{{if}\mspace{14mu}\rho_{t}} = 0} \\{( {{s_{{ran},0,t}{\overset{->}{v}}_{t}},0^{u_{t}},{\overset{->}{\eta}}_{{ran},0,t},0^{z_{t}}} )_{{??}_{t}^{*}},} & {{{if}\mspace{14mu}\rho_{t}} = 1}\end{matrix} \}:t} = 1},\ldots\mspace{14mu},L} )},\mspace{20mu}( {{s_{{ran},0,{L + 1}}{\overset{->}{e}}_{\tau,1}},0^{u_{\tau}},{\overset{->}{\eta}}_{{ran},0,{({\tau,l})}},0^{z_{\tau}}} )_{{??}_{\tau}^{*}}} ),\mspace{20mu}{k_{L,{del},{({\tau,l,0})}}^{*}:=( {( {{- s_{{del},0,0}},0^{u_{0}},0,{\overset{->}{\eta}}_{{del},0,0},0^{z_{0}}} )_{{??}_{0}^{*}},{{\{ \begin{matrix}{( {{{s_{{del},0,t}{\overset{->}{e}}_{t,1}} + {\theta_{{del},0,t}{\overset{->}{v}}_{t}}},0^{u_{t}},{\overset{->}{\eta}}_{{del},0,t},0^{z_{t}}} )_{{??}_{t}^{*}},} & {{{if}\mspace{14mu}\rho_{t}} = 0} \\{( {{s_{{del},0,t}{\overset{->}{v}}_{t}},0^{u_{t}},{\overset{->}{\eta}}_{{del},0,t},0^{z_{t}}} )_{{??}_{t}^{*}},} & {{{if}\mspace{14mu}\rho_{t}} = 1}\end{matrix} \}:t} = 1},\ldots\mspace{14mu},L} )},\mspace{20mu}( {{s_{{del},0,{L + 1}}{\overset{->}{e}}_{\tau,1}},{{+ \psi}{\overset{->}{e}}_{\tau,l}},0^{u_{\tau}},{\overset{->}{\eta}}_{{del},0,{({\tau,l})}},0^{z_{\tau}}} )_{{??}_{\tau}^{*}}} ),} & \lbrack {{Formula}\mspace{14mu} 195} \rbrack \\{ \mspace{79mu}{{k_{L,{del},{({\tau,t,1})}}^{*}:=( {( {{{- s_{{del},1,0}}0^{u_{0}}},0,{\overset{->}{\eta}}_{{del},1,0},0^{z_{0}}} )_{{??}_{0}^{*}},{{\{ \begin{matrix}( {{{s_{{del},1,t}{\overset{->}{e}}_{t,1}} + {\theta_{{del},1,t}{\overset{->}{v}}_{t}}},0^{u_{t}},{\overset{->}{\eta}}_{{del},1,t},0^{z_{t}}} )_{{??}_{t}^{*}} & {{{if}\mspace{14mu}\rho_{t}} = 0} \\{( {{s_{{del},1,t}{\overset{->}{v}}_{t}},0^{u_{t}},{\overset{->}{\eta}}_{{del},1,t},0^{z_{t}}} )_{{??}_{t}^{*}},} & {{{if}\mspace{14mu}\rho_{t}} = 1}\end{matrix} \}:t} = 1},\ldots\mspace{14mu},L} )},\mspace{20mu}( {{s_{{del},1,{L + 1}}{\overset{->}{e}}_{\tau,l}},0^{u_{\tau}},{\overset{->}{\eta}}_{{del},1,{({\tau,l})}},0^{z_{t}}} )_{{??}_{\tau}^{*}}} ),\mspace{20mu}{{sk}_{L}:=\begin{pmatrix}{{( {( {{\overset{->}{v}}_{1},\rho_{1}} ),\ldots\mspace{14mu},( {{\overset{->}{v}}_{L},\rho_{L}} )} );k_{L,{dec}}^{*}},\{ k_{L,{ran},j}^{*} \}_{{j = 1},\mspace{11mu}\ldots\mspace{14mu},{2L}},} \\\begin{Bmatrix}{k_{L,{ran},{({\tau,l,0})}}^{*},k_{L,{del},{({\tau,l,0})}}^{*},} \\k_{L,{del},{({\tau,l,1})}}^{*}\end{Bmatrix}_{{\tau = {L + 1}},\mspace{11mu}\ldots\mspace{14mu},{d;{{({\tau,l})} = {({\tau,1})}}},\mspace{11mu}\ldots\mspace{14mu},{({\tau,n_{\tau}})}}\end{pmatrix}},\mspace{20mu}{{return}\mspace{14mu}{{sk}_{L}.}}} & \; \\{\mspace{79mu}{{Enc}( {{pk},{m \in {??}_{T}},{{( {{\overset{->}{x}}_{1},\ldots\mspace{14mu},{\overset{->}{x}}_{L}} ):={( {( {x_{1,1},\ldots\mspace{14mu},x_{1,n_{1}}} ),\ldots\mspace{14mu},( {x_{L,1},\ldots\mspace{14mu},x_{L,n_{L}}} )} ):\mspace{20mu}{{( {{\overset{->}{x}}_{L + 1},\ldots\mspace{14mu},{\overset{->}{x}}_{d}} )\overset{U}{\longleftarrow}{\mathbb{R}}^{n_{L + 1}}} \times \ldots \times {\mathbb{R}}^{n_{d}}}}};\mspace{20mu}\omega},{\zeta\overset{U}{\longleftarrow}{\mathbb{R}}},{{\overset{->}{\varphi}}_{t}\overset{U}{\longleftarrow}{{\mathbb{R}}^{z_{t}}( {{t = 0},\ldots\mspace{14mu},d} )}},\mspace{20mu}{c_{1}:=( {( {\omega,0^{u_{0}},\zeta,0^{w_{0}},{\overset{->}{\varphi}}_{0}} )_{{??}_{0}},{{( {{\omega\;{\overset{->}{x}}_{t}},0^{u_{t}},0^{w_{t}},{\overset{->}{\varphi}}_{t}} )_{{??}\; t}:t} = 1},\ldots\mspace{14mu},d} )},\mspace{20mu}{c_{2}:={g_{T}^{\zeta}m}},\mspace{20mu}{{ct}:=( {{( {{\overset{->}{x}}_{1},\ldots\mspace{14mu},{\overset{->}{x}}_{L}} );c_{1}},c_{2}} )},\mspace{20mu}{{return}\mspace{14mu}{{ct}.}}} }} & \lbrack {{Formula}\mspace{14mu} 196} \rbrack \\{\mspace{79mu}{{{{{Dec}( {{pk},{sk}_{L},{ct}} )}:K}:={{e( {c_{1,0},k_{L,{dec},0}^{*}} )} \cdot {\prod\limits_{{1 \leq t \leq {d\bigwedge\rho_{t}}} = 0}{{e( {c_{1,t},k_{L,{dec},t}^{*}} )} \cdot {\prod\limits_{{1 \leq t \leq {d\bigwedge\rho_{t}}} = 1}{e( {c_{1,t},k_{L,{dec},t}^{*}} )}^{1/{({{\overset{->}{v}}_{t} \cdot {\overset{->}{x}}_{t}})}}}}}}},\mspace{20mu}{{{where}\mspace{20mu}( {{k_{L,{dec},0}^{*} \in \langle {??}_{0}^{*} \rangle},\ldots\mspace{14mu},{k_{L,{dec},d}^{*} \in \langle {??}_{d}^{*} \rangle}} )}:=k_{L,{dec}}^{*}},\mspace{20mu}( {{c_{1,0} \in \langle {??}_{0}^{*} \rangle},\ldots\mspace{14mu},{{c_{1,d} \in \langle {??}_{d}^{*} \rangle}:=c_{1}},\mspace{20mu}{m^{\prime}:={c_{2}/K}},\mspace{20mu}{{return}\mspace{14mu}{m^{\prime}.}}} }} & \lbrack {{Formula}\mspace{14mu} 197} \rbrack \\{\mspace{79mu}{{{{Delegate}_{L}( {{pk},{sk}_{L},{( {\overset{->}{v}}_{{L + 1},\rho_{L + 1}} ):=( {( v_{{L + 1},1,\mspace{11mu}\ldots\mspace{14mu},v_{{L + 1},n_{L + 1}}} ),\rho_{L + 1}} )}} )}:\mspace{20mu}{for}}\mspace{20mu}{{j = 1},\ldots\mspace{14mu},{{2L};}}\mspace{20mu}{{j^{\prime} = 1},\ldots\mspace{14mu},{{2( {L + 1} )};}}\mspace{20mu}{{\tau = {L + 2}},\ldots\mspace{14mu},{d;}}\mspace{20mu}{{( {\tau,l} ) = ( {\tau,1} )},\ldots\mspace{14mu},{( {\tau,n_{\tau}} );}}\mspace{20mu}{{t = 0},\ldots\mspace{14mu},{L + 1},{\tau;}}\mspace{20mu}{{( {t,i} ) = ( {t,1} )},\ldots\mspace{14mu},{( {t,w_{t}} );}}\mspace{20mu}{\alpha_{{dec},j},\sigma_{dec},\alpha_{{ran},j^{\prime},j},\sigma_{{ran},j^{\prime}},\alpha_{{ran},{({\tau,l,0})},j},\sigma_{{ran},{({\tau,l,0})}},\phi_{{ran},{({\tau,l,0})}},\mspace{20mu}\alpha_{{del},{({\tau,l,0})},j},\sigma_{{del},{({\tau,l,0})}},\phi_{{del},{({\tau,l,0})}},\alpha_{{del},{({\tau,l,1})},j},\sigma_{{del},{({\tau,l,1})}},\phi_{{del},{({\tau,l,1})}},\mspace{20mu}\eta_{{dec},{({t,i})}},\eta_{{ran},j^{\prime},{({t,i})}},\eta_{{ran},{({\tau,l,0})},{({t,i})}},\eta_{{del},{({\tau,l,0})},{({t,i})}},\eta_{{del},{({\tau,t,1})},{({t,i})}},\mspace{20mu}\psi_{0},\psi_{1},{\overset{U}{\longleftarrow}{\mathbb{R}}},{k_{{L + 1},{dec}}^{*}:={k_{L,{dec}}^{*} + {\sum\limits_{j = 1}^{2L}{\alpha_{{dec},j}k_{L,{ran},j}^{*}}} + \begin{Bmatrix}( {\sigma_{dec}( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i,0})}}^{*}}} )}  & {{{if}\mspace{14mu}\rho_{t}} = 0} \\( {\sigma_{dec}( {\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \rbrack^{L} + {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \rbrack}_{L}}} )}  & {{{if}\mspace{14mu}\rho_{t}} = 1}\end{Bmatrix} + {\sum\limits_{i = 1}^{w_{t}}{\eta_{{dec},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{dec},{({t,i})}}b_{t,{n_{t} + u_{t} + i},}^{*}}}}}}}{k_{{L + 1},{ran},j^{\prime}}^{*}:={{\sum\limits_{j = 1}^{2L}{\alpha_{{ran},j^{\prime},j}k_{L,{ran},j}^{*}}} + \begin{Bmatrix}{\sigma_{{ran},j^{\prime}}( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i,0})}}^{*}}} )} & {{{if}\mspace{14mu}\rho_{t}} = 0} \\{\sigma_{{ran},j^{\prime}}( {\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \rbrack^{L} + {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \rbrack}_{L}}} )} & {{{if}\mspace{14mu}\rho_{t}} = 1}\end{Bmatrix} + {\sum\limits_{i = 1}^{w_{t}}{\eta_{{ran},j^{\prime},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{ran},j^{\prime},{({t,i})}}b_{t,{n_{t} + u_{t} + i},}^{*}}}}}}}} & \lbrack {{Formula}\mspace{14mu} 198} \rbrack \\{{k_{{L + 1},{ran},{({\tau,l,0})}}^{*}:={{\sum\limits_{j = 1}^{2L}{\alpha_{{ran},{{({\tau,l})}j},}k_{L,{ran},j}^{*}}} + {\phi_{{ran},{({\tau,l,0})}}k_{L,{ran},{({\tau,l,0})}}^{*}} + \begin{Bmatrix}{\sigma_{{ran},{({\tau,l,0})}}( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i,0})}}^{*}}} )} & {{{if}\mspace{14mu}\rho_{t}} = 0} \\{\sigma_{{ran},{({\tau,l,0})}}( {\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \rbrack^{L} + {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \rbrack}_{L}}} )} & {{{if}\mspace{14mu}\rho_{t}} = 1}\end{Bmatrix} + {\sum\limits_{i = 1}^{w_{t}}{\eta_{{del},{({\tau,l,0})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{del},{({\tau,l,0})},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}} + {\sum\limits_{i = 1}^{w_{t}}{\eta_{{del},{({\tau,l,0})},{({\tau,i})}}b_{\tau,{n_{\tau} + u_{\tau} + i}}^{*}}}}},} & \; \\{{{{k_{{L + 1},{del},{({\tau,l,0})}}^{*}:={{\sum\limits_{j = 1}^{2L}{\alpha_{{del},{({\tau,l,0})},j}k_{L,{ran},j}^{*}}} + {\phi_{{del},{({\tau,l,0})}}k_{L,{{ran}{({\tau,l,0})}}}^{*}} + {\psi_{0}k_{L,{{del}{({\tau,l,0})}}}^{*}} + \begin{Bmatrix}{\sigma_{{del},{({\tau,l,0})}}( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i,0})}}^{*}}} )} & {{{if}\mspace{14mu}\rho_{t}} = 0} \\{\sigma_{{del},{({\tau,l,0})}}( {\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \rbrack^{L} + {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \rbrack}_{L}}} )} & {{{if}\mspace{14mu}\rho_{t}} = 1}\end{Bmatrix} + {\sum\limits_{i = 1}^{w_{t}}{\eta_{{del},{({\tau,l,0})},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{del},{({\tau,l,0})},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}} + {\sum\limits_{i = 1}^{w_{\tau}}{\eta_{{del},{({\tau,l,0})},{({\tau,i})}}b_{\tau,{n_{\tau} + u_{\tau} + i},}^{*}}}}}{k_{{L + 1},{del},{({\tau,l,1})}}^{*}:={{\sum\limits_{j = 1}^{2L}{\alpha_{{del},{({\tau,l,1})},j}k_{L,{ran},j}^{*}}} + {\psi_{1}k_{L,{{del}{({\tau,l,1})}}}^{*}} + \begin{Bmatrix}{\sigma_{{del},{({\tau,l,1})}}( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i,0})}}^{*}}} )} & {{{if}\mspace{14mu}\rho_{t}} = 0} \\{\sigma_{{del},{({\tau,l,1})}}( {\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \rbrack^{L} + {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \rbrack}_{L}}} )} & {{{if}\mspace{14mu}\rho_{t}} = 1}\end{Bmatrix} + {\sum\limits_{i = 1}^{w_{t}}{\eta_{{del},{({\tau,l,1})},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{i}}{\eta_{{del},{({\tau,l,1})},i}b_{t,{n_{t} + u_{t} + i}}^{*}}}} + {\sum\limits_{i = 1}^{w_{\tau}}{\eta_{{del},{({\tau,l,1})},{({\tau,i})}}b_{\tau,{n_{\tau} + u_{\tau} + i},}^{*}}}}}}{{{sk}_{L + 1}:=( {{( {( {{\overset{->}{v}}_{1},\rho_{1}} ),\ldots\mspace{14mu},( {{\overset{->}{v}}_{L + 1},\rho_{L + 1}} )} );k_{{L + 1},{dec}}^{*}},\{ k_{{L + 1},{ran},j^{\prime}}^{*} \}_{{j^{\prime} = 1},\mspace{11mu}\ldots\mspace{14mu},{2{({L + 1})}}},\{ {k_{{L + 1},{ran},{({\tau,l,0})}}^{*},k_{{L + 1},{del},{({\tau,l,0})}}^{*},k_{{L + 1},{del},{({\tau,l,1})}}^{*}} \}_{{\tau = {L + 2}},\mspace{11mu}\ldots\mspace{14mu},{d;{{({\tau,l})} = {({\tau,1})}}},\mspace{11mu}\ldots\mspace{14mu},{({\tau,n_{\tau}})}}} )},\mspace{20mu}{{return}\mspace{14mu}{{sk}_{L + 1}.}}}}\mspace{65mu}} & \lbrack {{Formula}\mspace{14mu} 199} \rbrack\end{matrix}$

A hardware configuration of the cryptographic processing system 10 (thekey generation device 100, the encryption device 200, the decryptiondevice 300, the key delegation device 400) in the embodiments will nowbe described.

FIG. 20 is a diagram showing an example of a hardware configuration ofthe key generation device 100, the encryption device 200, the decryptiondevice 300, and the key delegation device 400.

As shown in FIG. 20, the key generation device 100, the encryptiondevice 200, the decryption device 300, and the key delegation device 400each include the CPU 911 (central processing unit, also called aprocessing unit, an arithmetic unit, a microprocessor, a microcomputer,or a processor). The CPU 911 is connected through a bus 912 with the ROM913, the RAM 914, the LCD 901 (liquid crystal display), the keyboard 902(K/B), the communication board 915, and the magnetic disk device 920,and controls these hardware devices. The magnetic disk device 920 (fixeddisk device) may be replaced with a storage device such as an opticaldisk device or a memory card read/write device. The magnetic disk device920 is connected through a predetermined fixed disk interface.

The ROM 913 and the magnetic disk device 920 are examples of anonvolatile memory. The RAM 914 is an example of a volatile memory. TheROM 913, the RAM 914, and the magnetic disk device 920 are examples of astorage device (memory). The keyboard 902 and the communication board915 are examples of an input device. The communication board 915 is anexample of a communication device. The LCD 901 is an example of adisplay device.

The magnetic disk device 920, the ROM 913, or the like stores anoperating system 921 (OS), a window system 922, programs 923, and files924. The programs 923 are executed by the CPU 911, the operating system921, and the window system 922.

The programs 923 store software or programs for executing the functionsdescribed hereinabove as “the master key generation unit 110”, “themaster key storage unit 120”, “the information input unit 130”, “thedecryption key generation unit 140”, “the key distribution unit 150”,“the master public key acquisition unit 210”, “the information inputunit 220”, “the ciphertext generation unit 230”, “the data transmissionunit 240”, “the decryption key acquisition unit 310”, “the datareceiving unit 320”, “the pairing operation unit 330”, “the messagecomputation unit 340”, “the decryption key acquisition unit 410”, “theinformation input unit 420”, “the delegation key generation unit 430”,“the key distribution unit 440” and so on, as well as other programs.The programs are read and executed by the CPU 911.

The files 924 store information, data, signal values, variable values,and parameters, such as “the master public key pk”, “the master secretkey sk”, “the decryption key sk_(L)”, “the delegation key sk_(L+1)”,“the ciphertext ct”, “the attribute information”, “the predicateinformation”, and “the message m” described hereinabove, each of whichis stored as an item of a “file” or a “database”. The “file” or“database” is stored in a storage device such as a disk or memory. Theinformation, data, signal values, variable values, and parameters storedin the storage device such as the disk or memory are read by the CPU 911through a read/write circuit to a main memory or a cache memory, and areused for operations of the CPU 911 such as extraction, search,reference, comparison, calculation, computation, processing, output,printing, and display. The information, data, signal values, variablevalues, and parameters are temporarily stored in the main memory, thecache memory, or a buffer memory during the operations of the CPU 911such as extraction, search, reference, comparison, calculation,computation, processing, output, printing, and display.

In the flowcharts described hereinabove, an arrow mainly represents aninput/output of data or a signal, and each data or signal value isstored in the RAM 914, or other types of storage medium such as anoptical disk, or an IC chip. The data or signal is transferred onlinethrough the bus 912, a signal line, a cable, other types of transfermedium, or a radio wave.

What is described hereinabove as “ . . . unit” may be “ . . . circuit”,“ . . . device”, “ . . . equipment”, “ . . . means”, or “ . . .function”, and may also be “ . . . step”, “ . . . procedure”, or “ . . .process”. What is described as “ . . . device” may be “ . . . circuit”,“ . . . equipment”, “ . . . means”, or “ . . . function”, and may alsobe “ . . . step”, “ . . . procedure”, or “ . . . process”. What isdescribed as “ . . . process” may be “ . . . step”. That is, what isdescribed as “ . . . unit” may be implemented by firmware stored in theROM 913. Alternatively, “ . . . unit” may be implemented solely bysoftware, or solely by hardware such as elements, devices, boards, andwiring, or by a combination of software and hardware, or by acombination including firmware. Firmware or software is stored as aprogram in a storage medium such as the ROM 913. The programs are readby the CPU 911 and executed by the CPU 911. That is, each program causesa computer or the like to function as “ . . . unit” described above.Alternatively, each program causes the computer or the like to execute aprocedure or a method of “ . . . unit” described above.

LIST OF REFERENCE SIGNS

10: cryptographic processing system, 100: key generation device, 110:master key generation unit, 120: master key storage unit, 130:information input unit, 140: decryption key generation unit, 141: randomnumber generation unit, 142: decryption element generation unit, 143:randomizing element generation unit, 144: delegation element generationunit, 150: key distribution unit, 200: encryption device, 210: masterpublic key acquisition unit, 220: information input unit, 221: attributeinformation input unit, 222: message input unit, 230: ciphertextgeneration unit, 231: random number generation unit, 232: ciphertext c1generation unit, 233: ciphertext c2 generation unit, 240: datatransmission unit, 300: decryption device, 310: decryption keyacquisition unit, 320: data receiving unit, 330: pairing operation unit,340: message computation unit, 400: key delegation device, 410:decryption key acquisition unit, 420: information input unit, 430:delegation key generation unit, 431: random number generation unit, 432:lower-level decryption element generation unit, 433: lower-levelrandomizing element generation unit, 434: lower-level delegation elementgeneration unit, 440: key distribution unit

The invention claimed is:
 1. A cryptographic processing system thatperforms a cryptographic process using a basis B_(t) and a basis B*_(t)for each integer t of t=1, . . . , L+1(L being an integer of 1 or more),the cryptographic processing system comprising: an encryption devicehaving a processor to execute a program, and a corresponding memory tostore the program, which when executed by the processor generates, as aciphertext ct, a vector in which attribute information x{right arrowover ( )}_(t) is embedded in a basis vector of the basis B_(t) for atleast some integer t of t=1, . . . , L; a decryption device having aprocessor to execute a program, and a corresponding memory to store theprogram, which when executed by the processor of the decryption deviceuses, as a decryption key sk_(L), a vector in which predicateinformation v{right arrow over ( )}_(t) is embedded in a basis vector ofthe basis B*_(t) for each integer t of t=1, . . . , L, performs apairing operation on the ciphertext ct generated by the encryptiondevice and the decryption key sk_(L), and decrypts the ciphertext ct; akey delegation device having a processor to execute a program, and acorresponding memory to store the program, which when executed by theprocessor of the key delegation device generates a lower-leveldecryption key sk_(L|1) of the decryption key sk_(L), based on a vectorin which predicate information v{right arrow over ( )}_(L+1) is embeddedin a basis vector of a basis B*_(L+1) and the decryption key sk_(L) usedby the decryption device; a key generation device including a processorand a corresponding memory that stores a program that is executed by theprocessor that generates the decryption key sk_(L), wherein theprocessor of the key generation device further executes instructionswhich: input predicate information v{right arrow over ()}_(t):=(v_(t,i))(i=1, . . . , n_(t)) for each integer t of t=1, . . . ,L; generate a decryption element using the predicate information v{rightarrow over ( )}_(t) input, a predetermined value Δ, a predeterminedvalue θ_(dec,t) for each integer t of t=1, . . . , L, and apredetermined value s_(dec,t) for each integer t of t=0, . . . , L suchthat s_(dec,0)=Σ_(t=1) ^(L)s_(dec,t), generates the decryption elementk*_(L,dec) in which -s_(dec,0) is set as a coefficient of a basis vectorb*_(0,p) (p being a predetermined value) of a basis B*₀, the Δ is set asa coefficient of a basis vector b*_(0,q) (q being a predetermined value)of the basis B*₀, and s_(dec,t)e{right arrow over ()}_(t,1)+θ_(dec,t)v_(t,i) (i=1, . . . , n_(t)) is set as a coefficientof a basis vector b*_(t,i) (i=1, . . . , n_(t)) of the basis B*_(t) foreach integer t of t=1, . . . , L; and transmit to the decryption devicethe decryption key sk_(L) including the decryption element k*_(L,dec),wherein the processor of the encryption device further executesinstructions which: input attribute information x{right arrow over ()}_(t):=(x_(t,i)) (i=1, . . . , n_(t)) for at least some integer t oft=1, , . . . , L; generate a ciphertext c1, using the attributeinformation x{right arrow over ( )}_(t) and predetermined values ω andζ, generates a ciphertext c1 in which the ω is set as a coefficient of abasis vector b_(0,p) of a basis B₀, the ζ is set as a coefficient of abasis vector b_(0,q) of the basis B₀, and ωx_(t,i) (i=1, . . . , n_(t))is set as a coefficient of a basis vector b_(t,i) (i=1, . . . , n_(t))of the basis B_(t) for the at least some integer t; and transmits to thedecryption device the ciphertext ct including the ciphertext c₁, andwherein the processor of the decryption device further executesinstructions which perform a pairing operation e(c₁, k*_(L,dec)) on theciphertext c₁ included in the ciphertext ct and the decryption elementk*_(L,dec) included in the decryption key sk_(L).
 2. The cryptographicprocessing system of claim 1, wherein the processor of the encryptiondevice further generates a ciphertext c₂ by multiplying a message m byg_(T) ^(Λζ) obtained by a value g_(T)=e(b_(0,1), b*_(0,1)), the Δ, andthe ζ, wherein the transmitting performed by the processor of theencryption device transmits to the decryption device the ciphertext ctincluding the ciphertext c₂ and the ciphertext c₁, wherein theperforming of the pairing performs the pairing operation e (c₁,k*_(L,dec)) and computes a session key K:=g_(T) ^(Δζ), and wherein theprocessor of the decryption further computes the message m by dividingthe ciphertext c₂ by the session key K.
 3. The cryptographic processingsystem of claim 1, wherein the processor of the of the key generationdevice further performs generating a delegation element k*_(L,del,(τ,ι))for an integer τ of τ=L+1 and each integer ι of ι=1, . . . , n_(τ), thegenerating of the delegation element k*_(L,del,(τ,ι)) performed by usinga predetermined value θ_(del,(τ,ι),t) for each integer t of t=1, . . . ,L , a predetermined value ψ, and a predetermined value s_(del,(τ,ι),t)for each integer t of t=0,. . . , L+1 such that s_(del,(τ,ι),0)=Σ_(t−1)^(L+1)s_(del,(τ,ι),t), and by setting -s_(del,(τ,ι),0) as thecoefficient of the basis vector b*_(0,p) of the basis B*₀, settings_(del,(τ,ι),t)e{right arrow over ( )}_(t,1)+θ_(del,(τ,ι),t)v_(t,i)(i=1, . . . , n_(t)) as the coefficient of the basis vector b*_(t),(i=1,. . . , n_(t)) of the basis B*_(t) for each integer t of t=1, . . . , L,and setting s_(del,(τ,ι),L+1)e{right arrow over ( )}_(τ,1)+ψe{rightarrow over ( )}_(τ,ι)(i=1, . . . , n_(τ)) as a coefficient of a basisvector b*_(τ,i) (i=1, . . . , n_(τ)) of a basis B*_(τ), wherein thetransmitting by the processor of the key generation device furtherincludes transmitting to the key delegation device the decryption keysk_(L) including the delegation element k*_(L,del,(,τ,ι)) and thedecryption element k*_(L,dec), and wherein the processor of the keydelegation device further inputs predicate information v{right arrowover ( )}_(L+1):=(v_(L+1,i))(i=1, . . . , n_(L+1)); using the predicateinformation v{right arrow over ( )}_(L+1) and the decryption key sk_(L),generates a lower-level decryption element k*_(L+1,dec) including avector shown in Formula 1; and transmits to a lower-level decryptiondevice a lower-level decryption key sk_(L+1) including the lower-leveldecryption element k*_(L+1,dec)k*_(L,dec)+Σ_(i=1) ^(n) ^(L+1) v_(L+1,i)k*_(L,del,(L+1,i)).  [Formula 1]4. The cryptographic processing system of claim 3, wherein thecryptographic processing system performs the cryptographic process usingthe basis B₀ having at least a basis vector b_(0,i) (i=1, . . . , 1+n₀,1+n₀+1, . . . , 1+n₀+1+u₀, . . . , 1+n₀+130 u₀+w₀, . . . ,1+n₀+1+u₀+w₀+z₀)(n₀, u₀, w₀, and z₀ respectively being an integer of 1or more), the basis B*₀ having at least a basis vector b*_(0,i) (i=1, .. . , 1+n₀, 1+n₀+1, . . . , 1+n₀+1+u₀, . . . , 1+n₀+1+u₀+w₀, . . . ,1+n₀+1+u₀+w₀+z₀)(n₀, u₀, w₀, and z₀ respectively being an integer of 1or more), the basis B_(t) (t=1, . . . , L+1) having at least a basisvector b_(t,i) (i=1, . . . , n_(t), . . . , n_(t)+u_(t), . . . ,n_(t)+u_(t)+w_(t), . . . , n_(t)+u_(t)+w_(t)+z_(t)) (u_(t), w_(t), andz_(t) respectively being an integer of 1 or more), and the basis B*_(t)(t=1, . . . , L+1) having at least a basis vector b*_(t,i) (i=1, . . . ,n_(t), . . . , n_(t)+u_(t), . . . , n_(t)+u_(t)+w_(t), . . . ,n_(t)+u_(t)+w_(t)+z_(t)), wherein the processor of the key delegationdevice generates the decryption element k*_(L,dec) as shown in Formula2, based on a random number η{right arrow over ()}_(dec,t):=(η_(dec,t,i))(i=1, . . . , w_(t)) for each integer t of t=0,. . . , L, and wherein the processor of the encryption device generatesthe ciphertext c₁ as shown in Formula 3, based on a random numberφ{right arrow over ( )}_(t):=(φ_(t,i))(i=1, . . . , z_(t)) for eachinteger t of t=0, . . . , Lk* _(L,dec):=((−s _(dec,0),0^(u) ⁰ ,Δ,{right arrow over (η)}_(dec,0),0^(z) ⁰ )B*₀, (s _(dec,t){right arrow over(e)}_(t,1)+θ_(dec,t){right arrow over (v)}_(t),0^(u) ^(t) ,{right arrowover (η)}_(dec,t),0^(z) ^(t) )B*_(t):t=1, . . . , L)  [Formula 2]c ₁:=((ω,0^(u) ⁰ ,ζ,0^(w) ⁰ ,{right arrow over (φ)}₀))B₀ O,(ω{rightarrow over (x)}_(t),0^(u) ^(t) ,0^(w) ^(t) , {right arrow over(φ)}_(t))BtO: t=1, . . . , L).  [Formula 3]
 5. The cryptographicprocessing system of claim 4, wherein the processor of the keygeneration device further executes instructions which: generate a firstrandomizing element k*_(L,ran,j) for each integer j of j=1, . . . , 2L,and generates a second randomizing element k*_(L,ran,(τ,ι)) for eachinteger τ of τ=L+1, . . . , d (d being an integer of L+1 or more) andeach integer ι of ι=1, . . . , n_(τ) with respect to each integer τ,generate the first randomizing element k*_(L,ran,j) as shown in Formula4, based on a predetermined value θ_(ran,j,t) for each integer t of t=1,. . . , L, a predetermined value s_(ran,j,t) for t=0, . . . , L suchthat s_(ran,j,0)=Σ_(t=1) ^(L)s_(ran,j,t), and a random number η{rightarrow over ( )}_(ran,j,t):=(η_(ran,j,t,i))(i=1, . . . , w_(t)) for eachinteger t of t=0, . . . , L, and generate the second randomizing elementk*_(L,ran,(τ,ι)) as shown in Formula 5, based on a predetermined valueθ_(ran,(τ,ι),t) for each integer t of t=1, . . . , L, a predeterminedvalue s_(ran(τ,ι),t) for t=0, . . . , L+1 such thats_(ran,(τ,ι),0)=Σ_(t=1) ^(L+1)s_(ran,(τ,ι),t), and a random numberη{right arrow over ( )}_(ran,(τ,ι),t):=(η_(ran,(τ,ι),t,i))(i=1, . . . ,w_(t)) for each integer t of t=0, . . . , L+1, wherein the processor ofthe of the key generation device further performs generating of thedelegation element k*_(L,del,(τ,ι)) as shown in Formula 6 for eachinteger τ of τ=L+1, . . . , d and each integer ι of ι=1, . . . , n_(τ)with respect to each integer τ, based on a random number η{right arrowover ( )}_(del,(τ,ι),t):=(η_(del,(τ,ι)t,i))(i=1, . . . , w_(t)) for eachinteger t of t=0, . . . , L+1, wherein the processor of the keygeneration device further transmits to the key delegation device thedecryption key sk_(L) including the first randomizing elementk*_(L,ran,j) and the second randomizing element k*_(L,ran,j,(τ,ι)), thedelegation element k*_(L,del,(τ,ι)), and the decryption elementk*_(L,dec), and wherein the generating of the lower-level decryptionelement k*_(L+1,dec) generates the lower-level decryption elementk*_(L+1,dec) as shown in Formula 7, using the predicate informationv{right arrow over ( )}_(L+1), the decryption key sk_(L), a randomnumber α_(dec,j) for each integer j of j=1, . . . , 2L, a random numberσ_(dec), and a random number η_(dec,(t,i)) for each integer t of t=0, .. . , L+1 and each integer i of i=1, . . . , w_(t) $\begin{matrix}{k_{L,{ran},j}^{*}:=( {( {{- s_{{ran},j,0}},0^{u_{0}},0,{\overset{->}{\eta}}_{{ran},j,0},0^{z_{0}}} )_{B_{0}^{*}},{{( {{{s_{{ran},j,t}{\overset{->}{e}}_{t,1}} + {\theta_{{ran},j,t}{\overset{->}{v}}_{t}}},0^{u_{t}},{\overset{->}{\eta}}_{{ran},j,t},0^{z_{t}}} )_{B_{t}^{*}}:t} = 1},\ldots\mspace{14mu},L} )} & \lbrack {{Formula}\mspace{14mu} 4} \rbrack \\{k_{L,{ran},{({\tau,l})}}^{*}:=( {( {{- s_{{ran},{({\tau,l})},0}},0^{u_{0}},0,{\overset{->}{\eta}}_{{ran},{({\tau,l})},0},0^{z_{0}}} )_{B_{0}^{*}},{{( {{{s_{{ran},{({\tau,l})},t}{\overset{->}{e}}_{t,1}} + {\theta_{{ran},{({\tau,l})},t}{\overset{->}{v}}_{t}}},0^{u_{t}},{\overset{->}{\eta}}_{{ran},{({\tau,l})},t},0^{z_{t}}} )_{B_{t}^{*}}:t} = 1},\ldots\mspace{14mu},{L( {{s_{{ran},{({\tau,l})},{L + 1}}{\overset{->}{e}}_{\tau,1}},0^{u_{\tau}},{\overset{->}{\eta}}_{{ran},{{{({\tau,l})}L} + 1}},0^{z_{\tau}}} )}_{B_{\tau}^{*}}} )} & \lbrack {{Formula}\mspace{14mu} 5} \rbrack \\{k_{L,{del},{({\tau,l})}}^{*}:=( {( {{- s_{{del},{({\tau,l})},0}},0^{u_{0}},0,{\overset{->}{\eta}}_{{del},{({\tau,l})},0},0^{z_{0}}} )_{B_{0}^{*}},{{( {{{s_{{del},{({\tau,l})},t}{\overset{->}{e}}_{t,1}} + {\theta_{{del},{({\tau,l})},t}{\overset{->}{v}}_{t}}},0^{u_{t}},{\overset{->}{\eta}}_{{del},{({\tau,l})},t},0^{z_{t}}} )_{B_{t}^{*}}:t} = 1},\ldots\mspace{14mu},{L( {{{s_{{del},{({\tau,l})},{L + 1}}{\overset{->}{e}}_{\tau,1}} + {\overset{->}{\psi e}}_{\tau,1}},0^{u_{\tau}},{\overset{->}{\eta}}_{{del},{({\tau,l})},{L + 1}},0^{z_{\tau}}} )}_{B_{\tau}^{*}}} )} & \lbrack {{Formula}\mspace{14mu} 6} \rbrack \\{k_{{L + 1},{dec}}^{*}:={k_{L,{dec}}^{*} + {\sum\limits_{j = 1}^{{2L} + 1}{\alpha_{{dec},j}k_{L,{ran},j}^{*}}} + {\sigma_{dec}( {\sum\limits_{i = 1}^{\;_{n_{L + 1}}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i})}}^{*}}} )} + {\sum\limits_{i = 1}^{w_{t}}{\eta_{{dec},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{dec},{({t,i})}}{b_{t,{n_{t} + u_{t} + i}}^{*}.}}}}}} & \lbrack {{Formula}\mspace{14mu} 7} \rbrack\end{matrix}$
 6. The cryptographic processing system of claim 5, whereinthe processor of the key delegation device further generates a firstlower-level randomizing element k*_(L+ran,j), for each integer j′ ofj′=1, . . . , 2(L+1), and generates a second lower-level randomizingelement k*_(L+1,ran,(τ,ι)) for each integer τ of τ=L+2, . . . , d (dbeing an integer of L+2 or more) and each integer ι of ι=1, . . . ,n_(τ) with respect to each integer τ, the first lower-level randomizingelement k*_(L+1,ran,j), being as shown in Formula 8, based on thepredicate information v{right arrow over ( )}_(L|1), the decryption keysk_(L), a random number σ_(ran,j′,j) for each integer j of j=1, . . . ,2L and each integer j′ of j′=1, . . . , 2(L+1), a random numberσ_(ran,j), for each integer j′ of j′=1, . . . , 2(L+1), and a randomnumber η_(ran,j′,(t,i)) for each integer t of t=0, . . . , L+1 and eachinteger i of i=1, . . . , w_(t), and generates the second lower-levelrandomizing element k*_(L+1,ran,(τ,ι)) as shown in Formula 9, based onthe predicate information v{right arrow over ( )}_(L+1), the decryptionkey sk_(L), a random number α_(ran,(τ,ι),j) for each integer j of j=1, .. . , 2L, a random number σ_(ran,(τ,ι)), a random number φ_(ran,(τ,ι)),and a random number η_(ran,(τ,ι)(t,i)) for each integer t of t=0, . . ., L+1, τ and each integer i of i=1, . . . , w_(t); and generates alower-level delegation element k*_(L+1,del,(τ,ι)) for each integer τ ofτ=L+2, . . . , d (d being an integer of L+2 or more) and each integer ιof ι=1, . . . , n_(τ) with respect to each integer τ, the lower-leveldelegation element k*_(L+1,del,(τ,ι)) being generated as shown inFormula 10, based on the predicate information v{right arrow over ()}_(L|1), the decryption key sk_(L), a random number α_(del,(τ,ι),j) foreach integer j of j=1, . . . , 2L, a random number σ_(del,(τ,ι)), arandom number ψ′, a random number φ_(del,(τ,ι)), and a random numberη_(del,(τ,ι),(t,i)) for each integer t of t=0, . . . , L+1, τ and eachinteger i of i=1, . . . , w_(t), and wherein the processor of the keydelegation device further transmits to a lower-level delegation device alower-level decryption key sk_(L+1) including the lower-level decryptionelement k*_(L+1,dec), the first lower-level randomizing elementk*_(L+1,ran,j′) and the second lower-level randomizing elementk*_(L+1,ran,(τ,ι)), and the lower-level delegation elementk*_(L+1,del,(τ,ι)) $\begin{matrix}{k_{{L + 1},{ran},j^{\prime}}^{*}:={{\sum\limits_{j = 1}^{{2L} + 1}{\alpha_{{ran},j^{\prime},j}k_{L,{ran},j}^{*}}} + {\sigma_{{ran},j^{\prime}}( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i})}}^{*}}} )} + {\sum\limits_{i = 1}^{w_{i}}{\eta_{{ran},j^{\prime},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{ran},j^{\prime},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}}}} & \lbrack {{Formula}\mspace{14mu} 8} \rbrack \\{k_{{L + 1},{ran},{({\tau,l})}}^{*}:={{\sum\limits_{j = 1}^{{2L} + 1}{\alpha_{{ran},{({\tau,l})},j}k_{L,{ran},j}^{*}}} + {\sigma_{{ran},{({\tau,l})}}( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i})}}^{*}}} )} + {\phi_{{ran},{({\tau,l})}}k_{L,{ran},{({\tau,l})}}^{*}} + {\sum\limits_{i = 1}^{w_{i}}{\eta_{{ran},{({\tau,l})},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{i}}{\eta_{{ran},{({\tau,l})},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}} + {\sum\limits_{i = 1}^{w_{\tau}}{\eta_{{ran},{({\tau,l})},{({\tau,i})}}b_{\tau,{n_{\tau} + u_{\tau} + i}}^{*}}}}} & \lbrack {{Formula}\mspace{14mu} 9} \rbrack \\{{k_{{L + 1},{del},{({\tau + l})}}^{*}:={{\sum\limits_{j = 1}^{{2L} + 1}{\alpha_{{del},{({\tau,l})},j}k_{L,{ran},j}^{*}}} + {\sigma_{{del},{({\tau,l})}}( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i})}}^{*}}} )} + {\psi^{\prime}k_{L,{del},{({\tau,l})}}^{*}} + {\phi_{{del},{({\tau,l})}}k_{L,{ran},{({\tau,l})}}^{*}} + {\sum\limits_{i = 1}^{w_{i}}{\eta_{{del},{({\tau,l})},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}{\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{del},{({\tau,l})},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}}}} + {\sum\limits_{i = 1}^{w_{\tau}}{\eta_{{del},{({\tau,l})},{({\tau,i})}}b_{\tau,{n_{\tau} + u_{\tau} + i}}^{*}}}}},.} & \lbrack {{Formula}\mspace{14mu} 10} \rbrack\end{matrix}$
 7. The cryptographic processing system of claim 1, whereinthe processor of the key generation device further executes instructionswhich: input predicate information (v{right arrow over ()}_(ι):=(v_(t,i)) (i=1, . . . , n_(t)), ρ_(ι)ε{0,1}) for each integer tof t=1, . . . , L, and generate the decryption element k*_(L,dec) inwhich -s_(dec,0) is set as the coefficient of the basis vector b*_(0,p),the Δ is set as the coefficient of the basis vector b*_(0,q), ands_(dec,t)e{right arrow over ( )}_(t,1)+θ_(dec,t)v_(t,i) (i=1, . . . ,n_(t)) when ρ_(t) is 0 or s_(dec,t)v_(t,i) (i=1, . . . , n_(t)) whenρ_(t) is 1 is set as the coefficient of the basis vector b*_(t,i) foreach integer t of t=1, . . . , L.
 8. The cryptographic processing systemof claim 7, wherein the processor of the key generation device furtherexecutes instruction which: generate a first delegation elementk*_(L,del,(τ,ι,0)) and a second delegation element k*_(L,del,(τ,ι,1))for an integer τ of τ=L+1 and each integer ι of ι=1, . . . , n_(τ); thefirst delegation element k*_(L,del,(τ,ι,0)) being generated by using apredetermined value θ_(del,0,t) for each integer t of t=1, . . . , L, apredetermined value ψ, and a predetermined value s_(del,0,t) for t=0, .. . , L+1 such that s_(del,0,0)=Σ_(t=1) ^(L+1)s_(del,0,t), and bysetting -s_(del,0,0) as the coefficient of the basis vector b*_(0,p) ofthe basis B*₀, setting s_(del,0,t)e{right arrow over ()}_(t,1)+θ_(del,0,t)v_(t,i) (i=1, . . . , n_(t)) when ρ_(t) is 0 ors_(del,0,t)v_(t,i) (i=1, . . . , n_(t)) when ρ_(t) is 1 as thecoefficient of the basis vector b*_(t,i) (i=1, . . . , n_(t)) for eachinteger t of t=1, . . . , L, and setting s_(del,0,L+1)e{right arrow over( )}_(τ,1)+ψe{right arrow over ( )}_(τ,ι) (i=1, . . . , n_(τ)) as acoefficient of a basis vector b*_(τ,i) (i=1, . . . , n_(τ)) of a basisB*_(τ); generate the second delegation element k*_(L,del,(τ,ι,1)) byusing a predetermined value θ_(del,1,t) for each integer t of t=1, . . ., L and a predetermined value s_(del,1,t) for t=0, . . . , L+1 such thats_(del,1,0)=Σ_(t=1) ^(L+1)s_(del,1,t), and by setting −s_(del,1,0) asthe coefficient of the basis vector b*_(0,p) of the basis B*₀, settings_(del,1,t)e{right arrow over ( )}_(t,1)+θ_(del,1,t)v_(t,i) (i=1, . . ., n_(t)) when ρ_(t) is 0 or s_(del,1,t)v_(t,i) (i=1, . . . , n_(t)) whenρ_(t) is 1 as the coefficient of the basis vector b*_(t,i) (i=1, . . . ,n_(t)) of the basis B*_(t) for each integer t of t=1, . . . , L, andsetting s_(del,1,L|1)e{right arrow over ( )}_(τ,1) (i=1, . . . , n_(τ))as the coefficient of the basis vector b*_(τ,i) (i=1, . . . , n_(τ)) ofthe basis B*_(τ); transmit to the key delegation device the decryptionkey sk_(L) including the first delegation element k*_(L,del,(τ,ι,0)) andthe second delegation element k*_(L,del,(τ,ι,1)) and the decryptionelement k*_(L,dec); wherein the processor of the key delegation devicefurther inputs predicate information (v{right arrow over ()}_(L+1):=(v_(L+1,i))(i=1, . . . , n_(L+1)), ρ_(L+1)ε{0,1}); andgenerates a lower-level decryption element k*_(L+1,dec) including avector shown in Formula 11, using the predicate information v{rightarrow over ( )}_(L+1) and the decryption key sk_(L)                                     [Formula  11]$k_{L,{dec}}^{*} + {\begin{Bmatrix}( {\sigma_{dec}( {\sum\limits_{t = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i,0})}}^{*}}} )}  & {{{if}\mspace{14mu}\rho_{t}} = 0} \\( {\sigma_{dec}( {\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \rbrack^{L} + {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \rbrack}_{L}}} )}  & {{{if}\mspace{14mu}\rho_{t}} = 1}\end{Bmatrix}.}$
 9. The cryptographic processing system of claim 8,wherein the cryptographic processing system performs the cryptographicprocess using the basis B₀ having at least a basis vector b_(0,i) (i=1,. . . , 1+n₀, 1+n₀+1, . . . , 1+n₀+1+u₀, . . . , 1+n₀+1+u₀+w₀, . . . ,1+n₀+1+u₀+w₀+z₀)(n₀, u₀, w₀, and z₀ respectively being an integer of 1or more), the basis B*₀ having at least a basis vector b*_(0,i) (i=1, .. . , 1+n₀, 1+n₀+1, . . . , 1+n₀+1+u₀, . . . , 1+n₀+1+u₀+w₀, . . . ,1+n₀+1+u₀+w₀+z₀)(n₀, u₀, w₀, and z₀ respectively being an integer of 1or more), the basis B_(t) (t=1, . . . , L+1) having at least a basisvector b_(t,i) (i=1, . . . , n_(t), . . . , n_(t)+u_(t), . . . ,n_(t)+u_(t)+w_(t), . . . , n_(t)+u_(t)+w_(t)+z_(t)) (u_(t), w_(t), andz_(t) respectively being an integer of 1 or more), and the basis B*_(t)(t=1, . . . , L+1) having at least a basis vector b*_(t,i) (i=1, . . . ,n_(t), . . . , n_(t)+u_(t), . . . , n_(t)+u_(t)+w_(t), . . . ,n_(t)+u_(t)+w_(t)+z_(t)), wherein the processor of the key generationdevice further executes instructions to generate the decryption elementk*_(L,dec) as shown in Formula 12, based on a random number n{rightarrow over ( )}_(dec,t):=(η_(dec,t,i))(i=1, . . . , w_(t)) for eachinteger t of t=0, . . . , L, and wherein the processor of the encryptiondevice further executes instructions to generate the ciphertext c₁ asshown in Formula 13, based on a random number φ{right arrow over ()}_(t):=(φ_(t,i)) (i=1, . . . , z_(t)) for each integer t of t=0, . . ., L                                      [Formula  12]$k_{L,{dec}}^{*}:={( {( {{- s_{{dec},0}},0^{u_{0}},1,{\overset{->}{\eta}}_{{dec},0},0^{z_{0}}} )_{B_{0}^{*}},{{\begin{Bmatrix}{( {{{s_{{dec},t}{\overset{->}{e}}_{t,1}} + {\theta_{{dec},t,}{\overset{->}{v}}_{t}}},0^{u_{t}},{\overset{->}{\eta}}_{{dec},t},0^{z_{t}}} )_{B_{t}^{*}},} & {{{if}\mspace{14mu}\rho_{t}} = 0} \\{( {{s_{{dec},t}{\overset{->}{v}}_{t}},0^{u_{t}},{\overset{->}{\eta}}_{{dec},t},0^{z_{t}}} )_{B_{t}^{*}},} & {{{if}\mspace{14mu}\rho_{t}} = 1}\end{Bmatrix}:t} = 1},\ldots\mspace{14mu},L} )\mspace{650mu}\lbrack {{Formula}\mspace{14mu} 13} \rbrack}$$c_{1}:={( {( {\omega,0^{u_{0}},\zeta,0^{w_{0}},{\overset{->}{\varphi}}_{0}} )_{B_{0}0},{{( {{\omega\;{\overset{->}{x}}_{t}},0^{u_{t}},0^{w_{t}},{\overset{->}{\varphi}}_{t}} )_{B_{t}0}:t} = 1},\ldots\mspace{14mu},L} ).}$10. The cryptographic processing system of claim 9, wherein theprocessor of the key generation device further executes instructionswhich: generate a first randomizing element k*_(L,ran,j) for eachinteger j of j=1, . . . , 2L, and generate a second randomizing elementk*_(L,ran,(τ,ι,0)) for each integer τ of τ=L+1, . . . , d (d being aninteger of L+1 or more) and each integer ι of ι=1, . . . , n_(τ) withrespect to each integer τ, the generating of the first randomizingelement k*_(L,ran,j) as shown in Formula 14, based on a predeterminedvalue θ_(ran,j,t) for each integer t of t=1, . . . , L, a predeterminedvalue s_(ran,j,t) for t=0, . . . , L such that s_(ran,j,0)=Σ_(t=1)^(L)s_(ran,j,t), and a random number η{right arrow over ()}_(ran,j,t):=(η_(ran,j,t,i))(i=1, . . . , w_(t)) for each integer t oft=0, . . . , L, and generate the second randomizing elementk*_(L,ran,(τ,ι,0)) as shown in Formula 15, based on a predeterminedvalue θ_(ran,0,t) for each integer t of t=1, . . . , L, a predeterminedvalue s_(ran,0,t) for t=0, . . . , L=1 such that s_(ran,0,0)=Σ_(t=1)^(L+1)s_(ran,0,t), a random number η{right arrow over ()}_(ran,0,t):=(η_(ran,0,t,i))(i=1, . . . , w_(t)) for each integer t oft=0, . . . , L, and a random number η{right arrow over ()}_(ran,0,(τ,ι)):=(η_(ran,0,(τ,ι),i))(i=1, . . . , w_(t)), wherein theprocessor of the key generation device generates the first delegationelement k*_(L,del,(τ,ι,0)) as shown in Formula 16 for each integer τ ofτ=L+1, . . . , d and each integer ι of ι=1, . . . , n_(τ) with respectto each integer τ, based on a random number η{right arrow over ()}_(del,0,t):=(η_(del,0,t,i))(i=1, . . . , w_(t)) for each integer t oft=0, . . . , L and a random number η{right arrow over ()}_(del,0,(τ,ι)):=(η_(del,0,(τ,ι),i))(i=1, . . . , w_(t)), and generatesthe second delegation element k*_(L,del,(τ,ι,1)) as shown in Formula 17for each integer τ of τ=L+1, . . . , d and each integer ι of ι=1, . . ., n_(τ) with respect to each integer τ, based on a random number η{rightarrow over ( )}_(del,1,t):=(η_(del,1,t,i))(i=1, . . . , w_(t)) for eachinteger t of t=0, . . . L and a random number η{right arrow over ()}_(del,1,(τ,ι)):=(η_(del,1,(τ,ι),i))(i=1, . . . , w_(t)), wherein theprocessor of the key generation device transmits to the key delegationdevice the decryption key sk_(L) including the first randomizing elementk*_(L,ran,j) and the second randomizing element k*_(L,ran,(τ,ι,0)), thefirst delegation element k*_(L,del,(τ,ι,0)) and the second delegationelement k*_(L,del,(τ,ι,1)), and the decryption element k*_(L,dec), andwherein the processor of the key delegation device generates thelower-level decryption element k*_(L+1,dec) as shown in Formula 18,using the predicate information v{right arrow over ( )}_(L+1), thedecryption key sk_(L), a random number α_(dec,j) for each integer j ofj=1, . . . 2L, a random number τ_(dec), and a random numberη_(dec,(t,i)) for each integer t of t=0, L+1 and each integer i of i=1,. . . , w_(t) $\begin{matrix}{k_{L,{ran},j}^{*}:=( {( {{- s_{{ran},j,0}},0^{u_{0}},0,{\overset{->}{\eta}}_{{ran},j,0},0^{z_{0}}} )_{B_{0}^{*}},{{\begin{Bmatrix}{( {{{s_{{ran},j,t}{\overset{->}{e}}_{t,1}} + {\theta_{{ran},j,t}{\overset{->}{v}}_{t}}},0^{u_{t}},{\overset{->}{\eta}}_{{ran},j,t},0^{z_{t}}} )_{B_{t}^{*}},} & {{{if}\mspace{14mu}\rho_{t}} = 0} \\{( {{s_{{ran},j,t}{\overset{->}{v}}_{t}},0^{u_{t}},{\overset{->}{\eta}}_{{ran},j,t},0^{z_{t}}} )_{B_{t}^{*}},} & {{{if}\mspace{14mu}\rho_{t}} = 1}\end{Bmatrix}:t} = 1},\ldots\mspace{14mu},L} )} & \lbrack {{Formula}\mspace{14mu} 14} \rbrack \\ {{k_{L,{ran},{({\tau,l,0})}}^{*}:=( {( {{- s_{{ran},0,0}},0^{u_{0}},0,{\overset{->}{\eta}}_{{ran},0,0},0^{z_{0}}} )_{B_{0}^{*}},{{\{ \begin{matrix}{( {{{s_{{ran},0,t}{\overset{->}{e}}_{t,1}} + {\theta_{{ran},0,t}{\overset{->}{v}}_{t}}},0^{u_{t}},{\overset{->}{\eta}}_{{ran},0,t},0^{z_{t}}} )_{B_{t}^{*}},} & {{{if}\mspace{14mu}\rho_{t}} = 0} \\{( {{s_{{ran},0,t}\overset{->}{v}},0^{u_{t}},{\overset{->}{\eta}}_{{ran},0,t},0^{z_{t}}} )_{B_{t}^{*}},} & {{{if}\mspace{14mu}\rho_{t}} = 1}\end{matrix} \}:t} = 1},\ldots\mspace{14mu},L} )},\mspace{20mu}( {{s_{{ran},0,{L + 1}}{\overset{->}{e}}_{\tau,1}},0^{u_{\tau}},{\overset{->}{\eta}}_{{ran},0,{({\tau,l})}},0^{z_{\tau}}} )_{B_{\tau}^{*}}} ) & \lbrack {{Formula}\mspace{14mu} 15} \rbrack \\ {{k_{L,{del},{({\tau,l,0})}}^{*}:=( {( {{- s_{{del},0,0}},0^{u_{0}},0,{\overset{->}{\eta}}_{{del},0,0},0^{z_{0}}} )_{B_{0}^{*}},{{\{ \begin{matrix}{( {{{s_{{del},0,t}{\overset{->}{e}}_{t,1}} + {\theta_{{del},0,t}{\overset{->}{v}}_{t}}},0^{u_{t}},{\overset{->}{\eta}}_{{del},0,t},0^{z_{t}}} )_{B_{t}^{*}},} & {{{if}\mspace{14mu}\rho_{t}} = 0} \\{( {{s_{{del},0,t}{\overset{->}{v}}_{t}},0^{u_{t}},{\overset{->}{\eta}}_{{del},0,t},0^{z_{t}}} )_{B_{t}^{*}},} & {{{if}\mspace{14mu}\rho_{t}} = 1}\end{matrix} \}:t} = 1},\ldots\mspace{14mu},L} )},\mspace{20mu}( {{s_{{del},0,{L + 1}}{\overset{->}{e}}_{\tau,1}},{{+ \psi}{\overset{->}{e}}_{\tau,l}},0^{u_{\tau}},{\overset{->}{\eta}}_{{del},0,{({\tau,l})}},0^{z_{r}}} )_{B_{\tau}^{*}}} ) & \lbrack {{Formula}\mspace{14mu} 16} \rbrack \\ {{k_{{L + 1},{del},{({\tau,l,1})}}^{*}:=( {( {{- s_{{del},1,0}},0^{u_{0}},0,{\overset{->}{\eta}}_{{del},1,0},0^{z_{0}}} )_{B_{0}^{*}},{{\begin{Bmatrix}{( {{{s_{{del},1,t}{\overset{->}{e}}_{t,1}} + {\theta_{{del},1,t}{\overset{->}{v}}_{t}}},0^{u_{t}},{\overset{->}{\eta}}_{{del},1,t},0^{z_{t}}} )_{B_{t}^{*}},} & {{{if}\mspace{14mu}\rho_{t}} = 0} \\{( {{s_{{del},1,t}{\overset{->}{v}}_{t}},0^{u_{t}},{\overset{->}{\eta}}_{{del},1,t},0^{z_{t}}} )_{B_{i}^{*}},} & {{{if}\mspace{14mu}\rho_{t}} = 1}\end{Bmatrix}:t} = 1},\ldots\mspace{14mu},L} )},\mspace{20mu}( {{s_{{del},1,{L + 1}}{\overset{->}{e}}_{\tau,l}},0^{u_{\tau}},{\overset{->}{\eta}}_{{del},1,{({\tau,l})}},0^{z_{\tau}}} )_{B_{\tau}^{*}}} ) & \lbrack {{Formula}\mspace{14mu} 17} \rbrack \\{k_{{L + 1},{dec}}^{*}:={k_{L,{dec}}^{*} + {\sum\limits_{j = 1}^{{2L} + 1}{\alpha_{{dec},j}k_{L,{ran},j}^{*}}} + \begin{Bmatrix}( {\sigma_{dec}( {\sum\limits_{j = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i,0})}}^{*}}} )}  & {{{if}\mspace{14mu}\rho_{t}} = 0} \\( {\sigma_{dec}( {\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \rbrack^{L} +} }  & {{{if}\mspace{14mu}\rho_{t}} = 1} \\ {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \rbrack}_{L}} ) & \;\end{Bmatrix} + {\sum\limits_{i = 1}^{w_{t}}{\eta_{{dec},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{dec},{({t,i})}}{b_{t,{n_{t} + u_{t} + i}}^{*}.}}}}}} & \lbrack {{Formula}\mspace{14mu} 18} \rbrack\end{matrix}$
 11. The cryptographic processing system of claim 10,wherein the processor of the key delegation device further generates afirst lower-level randomizing element k*_(L+1,ran,j), for each integerj′ of j′=1, . . . , 2(L+1), and generates a second lower-levelrandomizing element k*_(L+1,ran,(τ,ι,0)) for each integer τ of τ=L+2, .. . d (d being an integer of L+2 or more) and each integer ι of ι=1, . .. , n_(τ) with respect to each integer τ, the generating of the firstlower-level randomizing element k*_(L+1,ran,j), being as shown inFormula 19, based on the predicate information v{right arrow over ()}_(L|1), the decryption key sk_(L), a random number α_(ran,j′,j) foreach integer j of j=1, . . . , 2L and each integer j′ of j′=1, . . . ,2(L+1), a random number σ_(ran,j), for each integer j′ of j′=1, . . . ,2(L+1), and a random number η_(ran,j′,(t,i)) for each integer t of t=0,. . . , L+1 and each integer i of i=1, . . . , w_(t), and the generatingof the second lower-level randomizing element k*_(L+1,ran,(τ,ι,0)) beingas shown in Formula 20, based on the predicate information v{right arrowover ( )}_(L+1), the decryption key sk_(L), a random numberα_(ran,(τ,ι),j) for each integer j of j=1, . . . , 2L, a random numberσ_(ran,(τ,ι,0)), a random number φ_(ran,(τ,ι, 0)), andη_(ran,(τ,ι,0),(t,i)) for each integer t of t=0, . . . , L+1 and eachinteger i of i=1, . . . , w_(t); and generates a first lower-leveldelegation element k*_(L+1,del,(τ,ι,0)) and a second lower-leveldelegation element k*_(L+1,del,(τ,ι,1)) for each integer τ of τ=L+2, . .. , d (d being an integer or L+2 or more) and each integer ι of ι=1, . .. , n_(τ) with respect to each integer τ, the generating of the firstlower-level delegation element k*_(L+1,del,(τ,ι,0)) as shown in Formula21, based on the predicate information v{right arrow over ( )}_(L+1),the decryption key sk_(L), a random number α_(del,(τ,ι,0),j) for eachinteger j of j=1, . . . , 2L, a random number σ_(del,(τ,ι,0)), a randomnumber ψ₀, a random number φ_(del,(τ,ι,0)), and η_(del,(τ,ι,0),(t,i))for each integer t of t=0, . . . , L+1 and each integer i of i=1, . . ., w_(t), and wherein the processor of the key delegation device furthergenerates the second lower-level delegation element k*_(L+1,del,(τ,ι,1))as shown in Formula 22, based on the predicate information v{right arrowover ( )}_(L+1), the decryption key sk_(L), a random numberα_(del,(τ,ι,1),j) for each integer j of j=1, . . . , 2L, and a randomnumber σ_(del,(τ,ι,1)), a random number ψ₁, a random numberφ_(del,(τ,ι,1)), and η_(del,(τ,ι,1),(t,i)) for each integer t of t=0, .. . , L+1 and each integer i of i=1, . . . , w_(t) $\begin{matrix}{k_{{L + 1},{ran},j^{\prime}}^{*}:={{\sum\limits_{j = 1}^{{2L} + 1}{\alpha_{{ran},j^{\prime},j}k_{L,{ran},j}^{*}}} + \begin{Bmatrix}{\sigma_{{ran},j^{\prime}}( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i,0})}}^{*}}} )} & {{{if}\mspace{14mu}\rho_{t}} = 0} \\{\sigma_{{ran},j^{\prime}}( {\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \rbrack^{L} + {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \rbrack}_{L}}} )} & {{{if}\mspace{14mu}\rho_{t}} = 1}\end{Bmatrix} + {\sum\limits_{i = 1}^{w_{t}}{\eta_{{ran},j^{\prime},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{ran},j^{\prime},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}}}} & \lbrack {{Formula}\mspace{14mu} 19} \rbrack \\{k_{{L + 1},{{ran}{({\tau,l,0})}}}^{*}:={{\sum\limits_{j = 1}^{{2L} + 1}{\alpha_{{ran},{{({\tau,l})}j},}k_{L,{ran},j}^{*}}} + {\phi_{{ran},{({\tau,l,0})}}k_{L,{ran},{({\tau,l,0})}}^{*}} + \begin{Bmatrix}{\sigma_{ran},_{({\tau,l,0})}( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i,0})}}^{*}}} )} & {{{if}\mspace{14mu}\rho_{t}} = 0} \\{\sigma_{ran},_{({\tau,l,0})}( {\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \rbrack^{L} + {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \rbrack}_{L}}} )} & {{{if}\mspace{14mu}\rho_{t}} = 1}\end{Bmatrix} + {\sum\limits_{i = 1}^{w_{t}}{\eta_{{del},{({\tau,l,0})},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{i = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{del},{({\tau,l,0})},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}} + {\sum\limits_{i = 1}^{w_{\tau}}{\eta_{{del},{({\tau,l,0})},{({\tau,i})}}b_{\tau,{n_{\tau} + u_{\tau} + i}}^{*}}}}} & \lbrack {{Formula}\mspace{14mu} 20} \rbrack \\{k_{{L + 1},{{del}{({\tau,l,0})}}}^{*}:={{\sum\limits_{j = 1}^{{2L} + 1}{\alpha_{{del},{({\tau,l,0})},j}k_{L,{ran},j}^{*}}} + {\phi_{{del},{({\tau,l,0})}}k_{L,{{ran}{({\tau,l,0})}}}^{*}} + {\psi_{0}k_{L,{{del}{({\tau,l,0})}}}^{*}} + \begin{Bmatrix}{\sigma_{{del},{({\tau,l,0})}}( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i,0})}}^{*}}} )} & {{{if}\mspace{14mu}\rho_{t}} = 0} \\{\sigma_{{del},{({\tau,l,0})}}( {\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \rbrack^{L} + {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \rbrack}_{L}}} )} & {{{if}\mspace{14mu}\rho_{t}} = 1}\end{Bmatrix} + {\sum\limits_{i = 1}^{w_{t}}{\eta_{{del},{({\tau,l,0})},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{del},{({\tau,l,0})},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}} + {\sum\limits_{i = 1}^{w_{\tau}}{\eta_{{del},{({\tau,l,0})},{({\tau,i})}}b_{\tau,{n_{\tau} + u_{\tau} + i}}^{*}}}}} & \lbrack {{Formula}\mspace{14mu} 21} \rbrack \\{k_{{L + 1},{{del}{({\tau,l,1})}}}^{*}:={{\sum\limits_{j = 1}^{{2L} + 1}{\alpha_{{{del}{({\tau,l,1})}},j}k_{L,{ran},j}^{*}}} + {\psi_{1}k_{L,{{del}{({\tau,l,1})}}}^{*}} + \begin{Bmatrix}{\sigma_{{del},{({\tau,l,1})}}( {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}k_{L,{del},{({{L + 1},i,0})}}^{*}}} )} & {{{if}\mspace{14mu}\rho_{t}} = 0} \\{\sigma_{{del},{({\tau,l,1})}}( {\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \rbrack^{L} + {\sum\limits_{i = 1}^{n_{L + 1}}{v_{{L + 1},i}\lbrack k_{L,{del},{({{L + 1},i,1})}}^{*} \rbrack}_{L}}} )} & {{{if}\mspace{14mu}\rho_{t}} = 1}\end{Bmatrix} + {\sum\limits_{i = 1}^{w_{t}}{\eta_{{del},{({\tau,l,1})},{({0,i})}}b_{0,{1 + u_{0} + 1 + i}}^{*}}} + {\sum\limits_{t = 1}^{L + 1}{\sum\limits_{i = 1}^{w_{t}}{\eta_{{del},{({\tau,l,1})},{({t,i})}}b_{t,{n_{t} + u_{t} + i}}^{*}}}} + {\sum\limits_{i = 1}^{w_{\tau}}{\eta_{{del},{({\tau,l,1})},{({\tau,i})}}{b_{\tau,{n_{\tau} + u_{\tau} + i}}^{*}.}}}}} & \lbrack {{Formula}\mspace{14mu} 22} \rbrack\end{matrix}$
 12. A cryptographic processing system, comprising: anencryption device; and a decryption device, separate from the encryptiondevice, that decrypt a ciphertext c₁ by a decryption key sk_(L) in acryptographic processing system that performs a cryptographic processusing a basis B_(t) and a basis B*_(t) for each integer t of t=1, . . ., L (L being an integer of 1 or more), the decryption device comprising:a processor to execute a program; and a memory to store the programwhich, when executed by the processor, results in performance of stepsincluding: receiving from the encryption device the ciphertext c₁ inwhich, using attribute information x{right arrow over ()}_(t):=(x_(t,i))(i=1, . . . , n_(t)) and predetermined values ω and ζ,the ω is set as a coefficient of a basis vector b_(0,p) (p being apredetermined value) of a basis B₀, the ζ is set as a coefficient of abasis vector b_(0,q) (q being a predetermined value) of the basis B₀,and ωx_(t,i) (i=1, . . . , n_(t)) is set as a coefficient of a basisvector b_(t,i) (i=1, . . . , n_(t)) of the basis B_(t) for at least someinteger t; obtaining from a key generation device the decryption keysk_(L) including a decryption element k*_(L,dec) in which, usingpredicate information v{right arrow over ( )}_(t):=(v_(t,i)) (i=1, . . ., n_(t)), a predetermined value Δ, a predetermined value θ_(dec,t) foreach integer t of t=1, . . . , L ,and a predetermined value s_(dec,t)for each integer t of t=0, . . . , L such that s_(dec,0)=Σ_(t=1)^(L)s_(dec,t), −s_(dec,0) is set as a coefficient of a basis vectorb*_(0,p) (p being a predetermined value) of a basis B*₀, the Δ is set asa coefficient of a basis vector b*_(0,q) (q being a predetermined value)of the basis B*₀, and s_(dec,t)e{right arrow over ()}_(t,1)+θ_(dec,t)v_(t,i) (i=1, . . . , n_(t)) is set as a coefficientof a basis vector b*_(ti) (i=1, . . . , n_(t)) of the basis B*_(t) foreach integer t of t=1, . . . , L; and performing a pairing operation e(c₁, k*_(L,dec)) on the ciphertext c₁ and the decryption elementk*_(L,dec) included in the decryption key k_(L), and decrypts theciphertext c₁.